joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477e84
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x477ed1
xor ebx, ebx
jmp 0x477ec6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.004096f8
test eax, eax
jne 0x477ec5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x477f81
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x477ea7
mov al, byte [ebp - 1]
sub al, 1
jb 0x477edc
je 0x477ee5
jmp 0x477eee
call fcn.0044de2c
mov edi, eax
jmp 0x477ef0
call fcn.00407698
mov edi, eax
jmp 0x477ef0
xor edi, edi
test di, di
je 0x477f81
xor ebx, ebx
jmp 0x477f2c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x477f2b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x477f20
call fcn.00407588
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x477f2b
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x477f81
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x477efd
xor ebx, ebx
jmp 0x477f76
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x477f75
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x477f6a
call fcn.00407588
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x477f75
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x477f81
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x477f3b
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47aad0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x47abaa
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x47abb8
call fcn.004799a8
mov eax, dword [esi + 0xc]
push eax
call fcn.004074a8
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x47ab28
mov eax, 0x47abec
call fcn.00479788
push 1
mov eax, dword [esi + 8]
push eax
call fcn.00407800
push 0x2710
mov eax, dword [esi + 8]
push eax
call fcn.00407830
cmp eax, 0x102
je 0x47ab13
push esp
mov eax, dword [esi + 8]
push eax
call fcn.004075f8
test eax, eax
je 0x47ab7b
cmp dword [esp], 0
jne 0x47ab5d
mov eax, 0x47ac1c
call fcn.00479788
jmp 0x47ab85
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x47ac3c
call fcn.004799a8
jmp 0x47ab85
mov eax, 0x47ac74
call fcn.00479788
mov eax, dword [esi + 8]
push eax
call fcn.004074a8
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x47abaa
push 0xfa
call fcn.004077f8
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x47aca8
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47aee6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x47ae8b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call fcn.004074d0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47ad1d
mov eax, 0x47af00
call fcn.00475364
xor edx, edx
push ebp
push 0x47ae20
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402acc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00407808
test eax, eax
jne 0x47ae09
call fcn.00407618
cmp eax, 0x3e5
je 0x47ad85
mov eax, 0x47af14
call fcn.00475364
xor edx, edx
push ebp
push 0x47adf2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x47adc5
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x47adc5
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.00407e60
cmp eax, 1
je 0x47ada3
pop dword fs:[0]
add esp, 8
push 0x47adf9
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00407648
mov ebx, eax
call fcn.00407618
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae27
mov eax, dword [ebp - 0xc]
push eax
call fcn.004074a8
ret
Function at 0x47ed7c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [0x4bec00]
cmp dword [eax], 2
jne 0x47eda7
call fcn.004076a0
and eax, 0xff
cmp ax, 5
jae 0x47edb3
mov dword [ebp - 0xc], 1
jmp 0x47eff7
push 0x47f004
call fcn.00407640
mov esi, eax
push 0x47f014
push esi
call fcn.00407658
mov edi, eax
push 0x47f02c
push esi
call fcn.00407658
mov dword [ebp - 0x10], eax
push 0x47f044
push esi
call fcn.00407658
mov dword [ebp - 0x14], eax
test edi, edi
je 0x47edf8
cmp dword [ebp - 0x10], 0
je 0x47edf8
cmp dword [ebp - 0x14], 0
jne 0x47ee04
mov dword [ebp - 0xc], 0x7f
jmp 0x47eff7
mov eax, ebx
call fcn.0047ec84
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x47eff0
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47ee4e
call fcn.00403628
jmp 0x47eff7
xor edx, edx
push ebp
push 0x47efd3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0xc]
shl eax, 5
call fcn.004095ac
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
dec edi
test edi, edi
jl 0x47ef10
inc edi
xor ebx, ebx
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov al, byte [esi + 6]
push eax
push esi
call fcn.00407418
test eax, eax
jne 0x47eec6
call fcn.00407618
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47eeb7
mov dword [ebp - 0xc], 0x57
call fcn.00403628
call fcn.00403628
jmp 0x47eff7
mov eax, ebx
shl eax, 2
mov edx, dword [ebp - 0x28]
mov ecx, dword [esi + 0x10]
mov dword [edx + eax*8], ecx
mov edx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 4], 1
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [edx + eax*8 + 0x18], ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [edx + eax*8 + 0x1c], ecx
add esi, 0x14
inc ebx
dec edi
jne 0x47ee7c
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47ef3b
call fcn.00403628
call fcn.00403628
jmp 0x47eff7
xor eax, eax
push ebp
push 0x47ef7a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ef81
mov eax, dword [ebp - 0x24]
push eax
call fcn.00407738
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x484fe8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4850ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x14c]
mov edx, 0x4850d4
call fcn.00403d40
mov eax, dword [ebp - 0x14c]
call fcn.00403efc
push eax
call fcn.00407548
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4850a1
xor eax, eax
push ebp
push 0x48509a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.00484f9c
test al, al
je 0x48506f
mov byte [ebp - 1], 1
jmp 0x485083
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00407550
test eax, eax
jne 0x48505a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850a1
mov eax, dword [ebp - 8]
push eax
call fcn.00407540
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850c1
lea eax, [ebp - 0x14c]
call fcn.00403ab8
ret

Function at 0x4850d8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403efc
push eax
call fcn.0044c6e0
test eax, eax
je 0x485118
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00403ce8
jmp 0x48511f
mov eax, ebx
call fcn.00403ab8
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x485128
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4be124]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403efc
push eax
call fcn.0044c6e0
test eax, eax
je 0x485168
mov eax, dword [esp + 4]
jmp 0x48516a
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x485174
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4be12c]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x4851b8
call fcn.0044c6e0
test eax, eax
je 0x4851ae
mov eax, dword [esp + 4]
jmp 0x4851b0
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x485480
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff0
call fcn.004076a0
mov edx, eax
and dx, 0xff
cmp dx, 5
jne 0x485507
shr ax, 8
cmp ax, 1
jb 0x485507
mov bl, 1
push esp
push 1
push 0
push 0x485510
push 0x80000001
call fcn.00407488
test eax, eax
jne 0x485509
mov dword [esp + 0xc], 4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x48554c
mov eax, dword [esp + 0x14]
push eax
call fcn.00407498
test eax, eax
jne 0x4854fc
cmp dword [esp + 4], 4
jne 0x4854fc
cmp dword [esp + 0xc], 4
jne 0x4854fc
cmp dword [esp + 8], 0
setne bl
mov eax, dword [esp]
push eax
call fcn.00407458
jmp 0x485509
xor ebx, ebx
mov eax, ebx
add esp, 0x10
pop ebx
ret
Function at 0x48557c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x485590
add esp, 0xfffffff0
call fcn.00403130
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0042f0fc
mov eax, dword [0x485634]
not eax
and eax, dword [esi + 0x40]
mov dword [esi + 0x40], eax
mov edx, 0x79
mov eax, esi
call fcn.0042c7d4
mov edx, 0x61
mov eax, esi
call fcn.0042c7f4
xor edx, edx
mov eax, esi
call fcn.0042d120
mov dl, 1
mov eax, esi
call fcn.004332bc
call fcn.004076a0
and eax, 0xff
cmp ax, 6
jae 0x4855ef
mov dx, 0xfffe
mov eax, esi
call fcn.0042d160
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call fcn.00407fe0
test eax, eax
je 0x485615
lea eax, [ebp - 0x3c]
push eax
call fcn.004078f0
mov edx, eax
mov eax, dword [esi + 0x58]
call fcn.0041849c
mov eax, esi
test bl, bl
je 0x48562a
call fcn.00403188
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x485638
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
call fcn.00408448
mov edx, edi
mov eax, esi
call fcn.00430154
mov ecx, 0x4856c8
mov edx, edi
mov eax, esi
call fcn.00430080
mov eax, dword [edi + 4]
or eax, 0x2000000
or eax, 0x4000000
or eax, 4
or eax, 1
or eax, 0x20
or eax, 8
mov dword [edi + 4], eax
call fcn.00485480
mov ebx, eax
mov byte [esi + 0x1f8], bl
test bl, bl
je 0x48569a
mov eax, dword [edi + 4]
or eax, 0x200
or eax, 0x400
mov dword [edi + 4], eax
jmp 0x4856b7
call fcn.004076a0
and eax, 0xff
cmp ax, 6
jb 0x4856b3
or dword [edi + 4], 0x200
jmp 0x4856b7
or dword [edi + 4], 2
or dword [edi + 8], 0x200
and dword [edi + 0x24], 0xfffffffc
pop edi
pop esi
pop ebx
ret

Function at 0x4864b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x486575
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407630
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x4864e6
mov eax, ebx
call fcn.004851c8
test al, al
je 0x48654e
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403c60
lea eax, [ebp - 8]
mov edx, 0x48658c
call fcn.00403d40
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004850d8
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.0040298c
mov edx, 0x486590
lea eax, [ebp - 0x14]
mov cl, 2
call fcn.0040295c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00403cdc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0048600c
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x4864d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48657c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret
Function at 0x486594
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48675c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call fcn.004077b0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48672f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403d38
cmp eax, 3
jne 0x48662b
mov eax, ebx
call fcn.004853d0
test al, al
jne 0x48660b
mov byte [ebp - 1], 0
call fcn.00403628
jmp 0x486736
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.004850d8
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00486994
mov byte [ebp - 1], 1
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x158]
mov edx, 0x486774
call fcn.00403d40
mov eax, dword [ebp - 0x158]
call fcn.00403efc
push eax
call fcn.00407548
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x486718
xor eax, eax
push ebp
push 0x486711
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00484f9c
test al, al
je 0x4866e6
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403ce8
lea edx, [ebp - 0x160]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x10]
call fcn.00403d40
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.004850d8
mov eax, dword [ebp - 0x15c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0048600c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407550
test eax, eax
jne 0x48667f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486718
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407540
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486736
mov eax, dword [ebp - 8]
push eax
call fcn.004077b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486763
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00403adc
lea eax, [ebp - 0x10]
call fcn.00403ab8
ret
Function at 0x486a18
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x486c11
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x486a9d
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0044c3d0
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0044bec0
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0044c088
test eax, eax
jne 0x486a9d
lea edx, [ebp - 4]
mov eax, edi
call fcn.0044c3a8
push 1
call fcn.004077b0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x486bdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x15c]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x15c]
mov edx, 0x486c28
call fcn.00403d40
mov eax, dword [ebp - 0x15c]
call fcn.00403efc
push eax
call fcn.00407548
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x486bc5
xor eax, eax
push ebp
push 0x486bbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00484f9c
test al, al
je 0x486b8f
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403ce8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0044c088
test eax, eax
je 0x486b8f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.004860f8
test eax, eax
jne 0x486b8f
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x10]
call fcn.00403d40
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.004850d8
mov eax, dword [ebp - 0x160]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0048600c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407550
test eax, eax
jne 0x486b05
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486bc5
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407540
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486be3
mov eax, dword [ebp - 8]
push eax
call fcn.004077b0
ret
Function at 0x489d48
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489f3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x408]
mov edx, 0x20
call fcn.0042c7d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x408]
mov edx, 0x20
call fcn.0042c7f4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x20
call fcn.0042c7d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x20
call fcn.0042c7f4
xor eax, eax
push ebp
push 0x489f11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x489f4c
call fcn.0044c6e0
test eax, eax
je 0x489e27
cmp byte [ebp - 0x158], 0
je 0x489e27
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x4bf4dc]
push eax
call fcn.0044c6d8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x408]
call fcn.00489c88
xor edx, edx
mov al, 6
call fcn.0049bb00
test al, al
je 0x489e85
push 0x27
lea edx, [ebp - 0x168]
mov eax, dword [0x4bec08]
mov eax, dword [eax]
call fcn.0044bec0
lea eax, [ebp - 0x168]
mov edx, 0x489f64
call fcn.00403d40
mov eax, dword [ebp - 0x168]
call fcn.00403efc
push eax
mov eax, dword [0x4bf4dc]
push eax
call fcn.0044c6d8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x40c]
call fcn.00489c88
jmp 0x489f07
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.004a0034
cmp dword [ebp - 4], 0
jne 0x489ea9
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.004a0034
cmp dword [ebp - 4], 0
je 0x489f07
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call fcn.0044c6e0
test eax, eax
je 0x489f07
cmp byte [ebp - 0x158], 0
je 0x489f07
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x4bf4dc]
push eax
call fcn.0044c6d8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x40c]
call fcn.00489c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489f1b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489f43
lea eax, [ebp - 0x168]
call fcn.00403ab8
lea eax, [ebp - 4]
call fcn.00403ab8
ret
Function at 0x492f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x493074
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4be91c]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x4be1ac]
mov edx, 0x80000002
xor eax, eax
call fcn.0044d8c4
test eax, eax
jne 0x492ff6
mov eax, esi
call fcn.00403d38
inc eax
push eax
mov eax, esi
call fcn.00403efc
push eax
push 1
push 0
mov eax, edi
call fcn.00403efc
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004074a0
test eax, eax
je 0x492feb
mov eax, 0x49308c
call fcn.00479788
mov eax, dword [ebp - 4]
push eax
call fcn.00407458
jmp 0x493000
mov eax, 0x4930c0
call fcn.00479788
test bl, bl
je 0x493059
mov eax, esi
call fcn.00403efc
push eax
call fcn.004078a0
test eax, eax
je 0x493027
push 0
push 0
push 0x1d
push 0xffff
call fcn.00407f10
jmp 0x493059
lea ecx, [ebp - 0xc]
mov edx, 0x4930ec
mov al, 0x33
call fcn.004731d0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0044e0b0
mov eax, dword [ebp - 8]
mov edx, dword [0x4bea70]
mov edx, dword [edx + 0xb0]
call fcn.0049124c
test al, al
je 0x493004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49307b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403adc
ret

Function at 0x49576c
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x49582d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call fcn.00407600
mov ebx, eax
cmp ebx, 0xffffffff
je 0x495812
test bl, 0x10
je 0x495812
lea ecx, [ebp - 4]
mov edx, 0x495844
mov eax, esi
call fcn.0044bffc
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x495858
mov eax, 0x495868
call fcn.0044c8f4
mov edx, 0x495880
mov eax, dword [ebp - 8]
call fcn.004096f8
test eax, eax
jne 0x495812
mov eax, dword [ebp - 4]
call fcn.00409e00
lea ecx, [ebp - 0xc]
mov edx, 0x4958b0
mov eax, esi
call fcn.0044bffc
mov eax, dword [ebp - 0xc]
call fcn.00409e00
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403efc
mov edi, eax
push edi
call fcn.004077c0
push edi
call fcn.00407798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495834
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret