joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ae8ec
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x168], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ae9c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x254]
call fcn.004c1b50
mov eax, dword [ebx + 0x254]
call fcn.004c1734
lea eax, [ebp - 4]
push eax
push 0x11
mov eax, ebx
call fcn.0043f298
push eax
call fcn.004627d0
test eax, eax
jne 0x5ae9a1
push 0x4209
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.004626c0
test eax, eax
je 0x5ae9a1
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.004040f4
mov ecx, dword [ebp - 0x168]
xor edx, edx
mov eax, dword [ebx + 0x254]
call fcn.004c1780
mov esi, eax
mov edx, dword [ebp - 0x160]
mov eax, esi
call fcn.004c0914
mov edx, dword [ebp - 0x160]
mov eax, esi
call fcn.004c0960
mov eax, dword [ebx + 0x254]
call fcn.004c1b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae9cc
lea eax, [ebp - 0x168]
call fcn.00403ec4
ret
Function at 0x5ae9d4
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5aec05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x254]
call fcn.004c1b50
call fcn.00407ee4
mov dword [0x735a84], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x5aea3b
bt dword [0x735a84], eax
jae 0x5aebc5
lea eax, [ebx + 0x41]
mov byte [ebp - 1], al
lea eax, [ebp - 0x170]
mov dl, byte [ebp - 1]
call fcn.0040406c
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0x5aec1c
call fcn.00404190
push 0x200
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404308
push eax
call fcn.004626c0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x174]
lea edx, [ebp - 0x160]
mov ecx, 0x104
call fcn.004040f4
mov edx, dword [ebp - 0x174]
mov eax, 0x5aec28
call fcn.00404430
dec eax
push eax
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x160]
mov ecx, 0x104
call fcn.004040f4
mov eax, dword [ebp - 0x178]
mov edx, 1
pop ecx
call fcn.0040434c
mov edi, dword [esi + 0x254]
xor edx, edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
push eax
push 0x5aec34
lea eax, [ebp - 0x180]
mov dl, byte [ebp - 1]
call fcn.0040406c
push dword [ebp - 0x180]
push 0x5aec40
push dword [ebp - 0xc]
lea eax, [ebp - 0x17c]
mov edx, 4
call fcn.00404204
mov ecx, dword [ebp - 0x17c]
mov eax, edi
pop edx
call fcn.004c1764
mov dl, 1
mov eax, esi
call fcn.004c2824
mov eax, edi
call fcn.004c16e0
mov edx, eax
dec edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
mov dl, 1
call fcn.004c0d54
mov eax, edi
call fcn.004c16e0
mov edx, eax
dec edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
push eax
mov eax, dword [ebp - 8]
call fcn.005aa458
mov edx, eax
pop eax
call fcn.004c0914
mov eax, edi
call fcn.004c16e0
mov edx, eax
dec edx
mov eax, dword [esi + 0x254]
call fcn.004c1a38
push eax
mov eax, dword [ebp - 8]
call fcn.005aa4c8
mov edx, eax
pop eax
call fcn.004c0960
mov eax, dword [ebp - 8]
call fcn.00404308
push eax
call fcn.00407eac
cmp eax, 4
jne 0x5aebbd
mov byte [esi + ebx + 0x33c], 1
jmp 0x5aebc5
mov byte [esi + ebx + 0x33c], 0
inc ebx
cmp ebx, 0x1a
jne 0x5aea2d
mov eax, dword [esi + 0x254]
call fcn.004c1b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aec0c
lea eax, [ebp - 0x180]
mov edx, 5
call fcn.00403ee8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x5aee50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5aef6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403f5c
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 0xc]
call fcn.005aa110
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0xc]
call fcn.00403f5c
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x5aef80
mov edx, dword [ebp - 0xc]
call fcn.00404190
mov eax, dword [ebp - 0x158]
call fcn.00404308
push eax
call fcn.00407e24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5aef3c
xor eax, eax
push ebp
push 0x5aef35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x150]
call fcn.005aed8c
pop ecx
test al, al
je 0x5aef0a
mov byte [ebp - 5], 1
jmp 0x5aef1e
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e2c
test eax, eax
jne 0x5aeef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aef3c
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aef71
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 0xc]
call fcn.00403ec4
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x5b034c
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
test dl, dl
jne 0x5b0423
call fcn.00407f74
movzx esi, ax
mov ebp, esi
mov eax, ebp
call fcn.005b033c
movzx edi, ax
mov eax, ebp
call fcn.005b0344
movzx eax, ax
cmp edi, 0x24
ja case.0x5b0388.0
movzx edi, byte [edi + 0x5b038f]
jmp dword [edi*4 + 0x5b03b4]
mov dl, 1
jmp 0x5b0423
mov dl, 4
jmp 0x5b0423
mov dl, 5
jmp 0x5b0423
mov dl, 6
jmp 0x5b0423
mov dl, 7
jmp 0x5b0423
mov dl, 8
jmp 0x5b0423
mov dl, 9
jmp 0x5b0423
mov dl, 0xa
jmp 0x5b0423
mov dl, 0xc
jmp 0x5b0423
mov dl, 0xb
jmp 0x5b0423
mov dl, 0xd
jmp 0x5b0423
sub eax, 2
jne 0x5b041d
mov dl, 3
jmp 0x5b0423
mov dl, 2
jmp 0x5b0423
mov dl, 1
cmp dl, byte [ebx + 0x356]
je 0x5b0497
mov eax, edx
mov byte [ebx + 0x356], al
mov byte [0x735a89], al
mov eax, ebx
call fcn.005b1d18
mov eax, dword [ebx + 0x2fc]
call fcn.00403124
mov eax, dword [0x730ea4]
mov eax, dword [eax]
call fcn.0045858c
mov ecx, ebx
mov dl, 1
mov eax, dword [0x5a867c]
call fcn.005b2d74
mov esi, eax
mov dword [ebx + 0x2fc], esi
mov eax, esi
call fcn.005b30a0
mov eax, dword [ebx + 0x2fc]
mov byte [eax + 0x51], 1
mov dword [eax + 0x68], ebx
mov edx, eax
mov eax, ebx
call fcn.00438fdc
mov byte [ebx + 0x300], 1
mov eax, ebx
call fcn.0043c704
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5b049c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5b066c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00404144
test eax, eax
je 0x5b062e
mov eax, dword [ebp - 4]
call fcn.00404144
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x5b050f
lea eax, [ebp - 4]
mov edx, 0x5b0684
call fcn.0040414c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403f5c
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x160]
mov ecx, 0x5b0690
mov edx, dword [ebp - 0x18]
call fcn.00404190
mov eax, dword [ebp - 0x160]
call fcn.00404308
push eax
call fcn.00407e24
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x5b062e
xor edx, edx
push ebp
push 0x5b0627
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x130]
call fcn.0040aedc
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x1c]
call fcn.0040a00c
mov eax, dword [ebp - 0x1c]
mov edx, 0x5b069c
call fcn.00404254
je 0x5b05f8
mov eax, dword [ebp - 0x1c]
mov edx, 0x5b06a8
call fcn.00404254
je 0x5b05f8
mov eax, dword [ebp - 0x15c]
and eax, 0x10
cmp eax, 0x10
je 0x5b05d0
mov eax, dword [ebp - 0x140]
mov edx, eax
neg eax
add eax, dword [ebp - 0x13c]
mov dword [ebp - 0x168], eax
fild dword [ebp - 0x168]
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x10]
wait
jmp 0x5b05f8
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00404190
mov eax, dword [ebp - 0x16c]
call fcn.005b049c
pop ecx
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x10]
wait
lea eax, [ebp - 0x15c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407e2c
test eax, eax
jne 0x5b0560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b062e
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407e1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0673
lea eax, [ebp - 0x16c]
call fcn.00403ec4
lea eax, [ebp - 0x164]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x5b0d14
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov dl, 1
mov eax, dword [0x435d08]
call fcn.00444e84
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x314], eax
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x5b0da0
call fcn.004626c0
test eax, eax
je 0x5b0d7e
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x314]
xchg edx, eax
call fcn.004451e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x314]
mov byte [eax + 0x36], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x314]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30c]
call fcn.004cbe04
mov esp, ebp
pop ebp
ret
Function at 0x5b0da4
Capabilities:
Enumerate files on windows
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
xor eax, eax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5b0f5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x73170c]
mov eax, dword [eax]
mov ax, word [eax + 0x38]
mov word [ebp - 0x12], ax
lea edx, [ebp - 4]
mov eax, dword [0x735a80]
call fcn.005aa110
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2b8]
mov ecx, 0x5b0f74
mov edx, dword [ebp - 4]
call fcn.00404190
mov eax, dword [ebp - 0x2b8]
call fcn.00404308
push eax
call fcn.00407e24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5b0f39
xor eax, eax
push ebp
push 0x5b0f32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x73170c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004569d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30c]
mov eax, dword [eax + 0x20c]
call fcn.004c8ad4
test dword [ebp - 0x2b4], 0x10
ja 0x5b0edc
lea edx, [ebp - 8]
lea eax, [ebp - 0x288]
call fcn.0040aedc
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404190
push 0x4200
push 0x160
lea eax, [ebp - 0x174]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404308
push eax
call fcn.004626c0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30c]
mov eax, dword [eax + 0x20c]
call fcn.004c8980
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c8424
mov ecx, dword [ebp - 0x170]
xor edx, edx
mov eax, ebx
call fcn.004c85f8
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x2b4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e2c
test eax, eax
jne 0x5b0e56
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0f39
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30c]
mov eax, dword [eax + 0x20c]
call fcn.004c8cb0
mov eax, dword [0x73170c]
mov eax, dword [eax]
mov dx, word [ebp - 0x12]
call fcn.004569d4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0f66
lea eax, [ebp - 0x2b8]
call fcn.00403ec4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403ee8
ret
Function at 0x5b50b0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3b8], 0xffffffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x435d08]
call fcn.00444e84
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3b4], ebx
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x5b52c8
call fcn.004626c0
mov edx, eax
mov eax, ebx
call fcn.004451e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
call fcn.0044521c
test eax, eax
je 0x5b5129
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
mov byte [eax + 0x36], 1
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x435d08]
call fcn.00444e84
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3b0], ebx
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x5b52c8
call fcn.004626c0
mov edx, eax
mov eax, ebx
call fcn.004451e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
call fcn.0044521c
test eax, eax
je 0x5b5188
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
mov byte [eax + 0x36], 1
mov dl, 1
mov eax, dword [0x45e78c]
call fcn.0045e9a8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5b5299
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0045ea84
mov cl, 1
mov edx, 0x5b52d4
mov eax, dword [ebp - 8]
call fcn.0045ebc8
xor eax, eax
push ebp
push 0x5b527c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5b52fc
mov eax, dword [ebp - 8]
call fcn.0045f51c
sub al, 1
jb 0x5b5249
jne 0x5b5266
mov edx, 0x5b52fc
mov eax, dword [ebp - 8]
call fcn.0045f2b8
mov edx, dword [ebp - 4]
mov dword [edx + 0x3b8], eax
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call fcn.005b4f3c
pop ecx
test al, al
je 0x5b522a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
call fcn.00445580
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3b8]
jge 0x5b5266
push ebp
call fcn.005b4ea8
pop ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3b8]
mov edx, 0x5b52fc
mov eax, dword [ebp - 8]
call fcn.0045f2a4
jmp 0x5b5266
push ebp
call fcn.005b4ea8
pop ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3b8]
mov edx, 0x5b52fc
mov eax, dword [ebp - 8]
call fcn.0045f2a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b5283
mov eax, dword [ebp - 8]
call fcn.0045ea54
ret
Function at 0x5baa3c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5baa44
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5bab93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004cbf44
test eax, eax
je 0x5bab78
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040aa94
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409d58
mov eax, dword [ebp - 0x18]
mov edx, 0x5baba8
call fcn.00404254
jne 0x5bab62
mov eax, ebx
call fcn.0043f298
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005ba8e8
mov eax, ebx
call fcn.004cbf44
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x20]
mov edx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.0040aa5c
mov eax, ebx
call fcn.004cbf44
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x24]
mov edx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x10]
call fcn.0040a9cc
cmp dword [ebp - 8], 0
je 0x5bab78
lea eax, [ebp - 0x14]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040434c
mov eax, dword [ebp - 0x14]
call fcn.00404308
push eax
call fcn.00407eac
cmp eax, 2
jne 0x5bab32
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005badac
jmp 0x5bab78
mov eax, dword [ebp - 8]
call fcn.005a4b2c
test al, al
je 0x5bab4a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005babc0
jmp 0x5bab78
mov eax, dword [ebp - 0x10]
push eax
push 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x5babb8
call fcn.005a99e0
jmp 0x5bab78
mov eax, dword [ebp - 4]
call fcn.005a4b2c
test al, al
je 0x5bab78
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005babc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bab9a
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403ee8
ret
Function at 0x5bc2d8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x5bc2ef
add esp, 0xfffffff0
call fcn.00403464
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, 0x7324dc
xor edx, edx
mov eax, ebx
call fcn.0044c498
mov dl, 1
mov eax, dword [0x412474]
call fcn.004030f4
mov dword [ebx + 0x68], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x435d08]
call fcn.00444e84
mov edx, eax
mov eax, ebx
call fcn.0044b888
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5bc500
call fcn.004626c0
test eax, eax
je 0x5bc367
mov edx, eax
mov eax, dword [ebx + 0x3c]
call fcn.004451e0
mov edx, 0x1fffffff
mov eax, dword [ebx + 0x3c]
call fcn.00445864
mov eax, dword [ebx + 0x3c]
mov byte [eax + 0x36], 1
push 0x1000
push 0
push 0
push 0
push 0x5bc504
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x70], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc50c
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x74], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc514
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x78], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc520
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x7c], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc528
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x80], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc530
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x84], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc538
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x88], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc544
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x8c], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc550
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x90], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc560
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x94], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc56c
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x98], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc578
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0x9c], eax
push 0x1000
push 0
push 0
push 0
push 0x5bc584
mov eax, dword [esi]
push eax
call fcn.00408904
mov dword [ebx + 0xa0], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5bc4f8
call fcn.004034bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bc6dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5bc7af
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, esi
mov edx, 0x104
call fcn.00404478
lea eax, [ebp - 0xc]
call fcn.00406a2c
push eax
push 1
call fcn.00410738
test eax, eax
jne 0x5bc799
xor eax, eax
push ebp
push 0x5bc792
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, eax
test ebx, ebx
je 0x5bc76e
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call fcn.004627d0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004627c8
test eax, eax
je 0x5bc76e
mov eax, esi
mov edx, ebx
call fcn.0040407c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc799
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc7b6
lea eax, [ebp - 0xc]
call fcn.00406a2c
ret
Function at 0x5bc7c0
Capabilities:
Enumerate files on windows
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2b8], edx
mov dword [ebp - 0x2c0], edx
mov dword [ebp - 0x2bc], edx
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5bc9bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x40]
xor esi, esi
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
lea edx, [ebp - 4]
mov ecx, 9
call fcn.005bc6dc
test al, al
je 0x5bc992
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x2b4]
mov edx, 0x5bc9d4
mov eax, dword [ebp - 4]
call fcn.005aa090
mov eax, dword [ebp - 0x2b4]
call fcn.00404308
push eax
call fcn.00407e24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5bc992
xor eax, eax
push ebp
push 0x5bc98b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x124]
call fcn.0040aedc
mov eax, dword [ebp - 8]
mov edx, 0x5bc9e4
call fcn.00404254
je 0x5bc95c
mov eax, dword [ebp - 8]
mov edx, 0x5bc9f0
call fcn.00404254
je 0x5bc95c
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005aa090
push 0x4201
push 0x160
lea eax, [ebp - 0x2b0]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404308
push eax
call fcn.004626c0
push 0
push 1
push 1
push ebx
push 0x5bdad4
push 0
lea edx, [ebp - 0x2bc]
lea eax, [esi + 4]
call fcn.0040a418
mov ecx, dword [ebp - 0x2bc]
lea eax, [ebp - 0x2b8]
mov edx, 0x5bc9fc
call fcn.00404190
mov eax, dword [ebp - 0x2b8]
push eax
lea eax, [esi + 0x22]
push eax
push 0
lea edx, [ebp - 0x2c0]
lea eax, [ebp - 0x2a4]
call fcn.0040aedc
mov edx, dword [ebp - 0x2c0]
xor ecx, ecx
mov eax, ebx
call fcn.005bc658
mov edi, eax
mov edx, dword [ebp - 0x2ac]
mov eax, edi
call fcn.00449eb8
mov eax, dword [ebx + 0x28]
mov edx, 3
call fcn.00449e70
mov edx, edi
call fcn.0044a194
mov eax, dword [ebx + 0x68]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e2c
test eax, eax
jne 0x5bc86b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc992
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407e1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc9c4
lea eax, [ebp - 0x2c0]
mov edx, 4
call fcn.00403ee8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403ee8
ret