joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40509b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401db1
push eax
push eax
push dword [ebp + 8]
call fcn.0040503a
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
mov dword [ebp - 0x148], eax
push reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
call fcn.00401e05
push dword [ebp + 0x10]
push eax
call fcn.00401e05
push eax
push eax
push dword [ebp + 8]
call fcn.0040503a
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindClose
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
leave
ret 0xc
Function at 0x4051d2
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00401e6a
mov dword [ebp - 4], eax
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
leave
ret 8
Function at 0x405885
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_PathCanonicalizeA
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push reloc.shlwapi.dll_PathIsRelativeA
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405725
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405725
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405725
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [reloc.wsock32.dll_WSACleanup]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e05
mov dword [ebp - 0x810], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00405885
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406a0a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [reloc.wsock32.dll_WSACleanup]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x824], 4
jne reloc.gdi32.dll_SetWorldTransform
push dword [eax]
pop dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push eax
call fcn.00401871
mov dword [ebp - 0x820], reloc.wsock32.dll_listen
cmp dword [ebp - 0x81c], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40706b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push reloc.shlwapi.dll_PathBuildRootA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
push 0
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push reloc.shlwapi.dll_StrDupA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x820], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040706b
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407296
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push reloc.shlwapi.dll_PathBuildRootA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x820], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407296
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4074c1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x810], eax
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00403eba
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x407685
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00401e6a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401e05
mov dword [ebp - 4], eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
leave
ret 0xc
Function at 0x4077b7
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_StrNCatA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_StrDupA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004077b7
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40884c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegGetUSValueW
push dword [ebp + 0xc]
call fcn.00401db1
mov dword [ebp - 0x148], eax
push reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je reloc.gdi32.dll_SetWorldTransform
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push 0
push dword [ebp + 0xc]
call fcn.00401db1
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e05
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0040884c
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
call fcn.00401e05
push eax
push eax
push dword [ebp + 8]
call fcn.00408807
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindClose
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
leave
ret 0xc