joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa5570
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.000ad8a0
add esp, 8
test eax, eax
je 0xa55d4
mov esi, eax
jmp 0xa55b4
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.000ad8a0
add esp, 8
mov esi, eax
test eax, eax
je 0xa55d4
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.000a4fe0
add esp, 0xc
xor edi, edi
test eax, eax
je 0xa55a0
cmp dword [eax + 4], 4
jne 0xa55a0
mov edi, dword [eax + 8]
jmp 0xa55a0
xor eax, eax
test edi, edi
je 0xa563b
test ebp, ebp
je 0xa563b
push ebp
call fcn.000ad830
add esp, 4
test eax, eax
je 0xa561b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0xa5622
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0xa5600
jmp 0xa5624
mov esi, 0x1505
jmp 0xa5624
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0xa5643
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0xa5664
inc ebx
dec ecx
je 0xa5639
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xa5639
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0xa5660
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.000ad830
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0xa5660
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.000ad850
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0xa5660
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0xa563b
Function at 0xa58c0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0xa59df
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0xa59d3
cmp ecx, 5
je 0xa59a3
cmp ecx, 4
jne 0xa59df
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0xa592d
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [0xef004]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.000a58c0
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 0x18]
jb 0xa5900
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [0xef004]
add esp, 4
push dword [esi + 0xc]
call dword [0xef004]
add esp, 4
push dword [esi + 0x10]
call dword [0xef004]
add esp, 4
push dword [esi + 0x14]
call dword [0xef004]
add esp, 4
push dword [esi + 8]
call dword [0xef004]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0xa59d0
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0xa59c4
xor edi, edi
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.000a58c0
add esp, 4
inc edi
cmp edi, dword [esi + 8]
jb 0xa59b0
push dword [esi + 4]
call dword [0xef004]
add esp, 4
push esi
jmp 0xa59d6
push dword [eax + 8]
call dword [0xef004]
add esp, 4
pop esi
pop edi
jmp dword [0xef004]
Function at 0xa5d10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0xa5e22
mov esi, dword [esp + 0x28]
test esi, esi
je 0xa5e22
cmp dword [esp + 0x2c], 0
je 0xa5e22
push esi
call fcn.000ad830
add esp, 4
test eax, eax
je 0xa5d7a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0xa5d81
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0xa5d60
jmp 0xa5d83
mov ebx, 0x1505
jmp 0xa5d83
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0xa5e2a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0xa5de7
call fcn.000a6ad0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0xa5e22
push ecx
call fcn.000ad830
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0xa5e9d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0xa5e48
inc edi
dec esi
je 0xa5d9c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0xa5da1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0xa5e40
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.000ad830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xa5e40
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.000ad850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xa5e40
mov eax, 0xffffffff
jmp 0xa5e22
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0xa5eb8
inc edi
dec esi
je 0xa5de2
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0xa5de7
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0xa5eb0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.000ad830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xa5eb0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.000ad850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xa5eb0
jmp 0xa5de7
Function at 0xa6820
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0xa6a0a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0xa6a0a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0xa6a0a
cmp dword [ecx], 0
jne 0xa6a0a
push esi
call fcn.000ad830
add esp, 4
test eax, eax
je 0xa688a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0xa6891
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0xa6870
jmp 0xa6893
mov edi, 0x1505
jmp 0xa6893
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0xa6964
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0xa68f1
call fcn.000a6ad0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0xa6a0a
push esi
call fcn.000ad830
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.000a6a20
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.000ad830
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0xef008]
add esp, 4
test eax, eax
je 0xa6a05
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.000ad730
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0xa6a0a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xa6988
inc ebx
dec edx
je 0xa68ac
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0xa68b1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0xa6980
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.000ad830
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0xa6980
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.000ad850
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0xa6980
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.000a58c0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0xa6959
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xa7aa0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0xa7c56
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0xa7c4f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0xa7b35
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0xa7c4f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0xa7bb5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0xa7b50
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0xa7afd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0xa7c00
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0xa7be0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0xa7af0
jmp 0xa7c0f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0xa7af0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0xa7c20
jmp 0xa7af0
shl ecx, 0x10
or ecx, edi
jmp 0xa7c5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xb3320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [0xee720]
shr eax, 0x1f
jmp dword [eax*4 + 0xf057c]
Function at 0xe0560
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ebx], 0
lea ebx, [ebx + 2]
jne 0xe0580
mov dword [esp + 8], 0x8e8e881f
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0xe05d6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
push dword [esp]
push eax
call fcn.000e4540
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0xe05b0
cmp ebx, 2
je 0xe05fc
lea eax, [ebx - 2]
mov edx, eax
sar edx, 1
mov edi, dword [esp + 8]
mov ecx, edi
not ecx
test al, 2
mov dword [esp + 0x10], ecx
jne 0xe0603
cmp ebx, 4
jne 0xe0637
jmp 0xe0690
mov eax, ebp
jmp 0xe0690
dec edx
movzx eax, word [esi]
xor eax, ebp
mov ebp, eax
or ebp, edi
mov dword [esp + 4], ebp
mov ebp, eax
and ebp, edi
imul ebp, dword [esp + 4]
mov dword [esp + 4], ebp
mov ebp, eax
not ebp
and ebp, edi
and eax, ecx
imul eax, ebp
add eax, dword [esp + 4]
add esi, 2
mov ebp, eax
cmp ebx, 4
je 0xe0690
xor ebx, ebx
mov eax, ebp
mov dword [esp + 4], edx
nop
movzx ebp, word [esi + ebx*2]
xor ebp, eax
mov eax, ebp
or eax, edi
mov ecx, ebp
and ecx, edi
imul ecx, eax
mov eax, ebp
not eax
and eax, edi
mov edx, esi
mov esi, dword [esp + 0x10]
and ebp, esi
imul ebp, eax
add ebp, ecx
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov ecx, eax
or ecx, edi
mov ebp, eax
and ebp, edi
imul ebp, ecx
mov ecx, eax
not ecx
and ecx, edi
and eax, esi
mov esi, edx
imul eax, ecx
mov edx, dword [esp + 4]
add eax, ebp
add ebx, 2
cmp edx, ebx
jne 0xe0640
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401c20
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401c32
call fcn.0040f3a0
mov eax, dword [0x413393]
shl eax, 2
mov dword [0x413397], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
mov dword [0x41339b], edx
call fcn.00408834
pop edx
call fcn.004066e0
call fcn.00408838
push 0x41333c
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x41339b], eax
push 0
jmp 0x4108c8
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x6c]
mov eax, dword [esi + 0x10]
and eax, 1
mov dword [0x415844], eax
call fcn.0040cabc
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040ced0
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call fcn.00409854
mov eax, dword [esi + 0x44]
mov dword [esp], eax
call fcn.00409864
mov dword [0x41da90], 1
mov dword [0x41da94], esi
lea eax, [esp + 0x10]
mov dword [0x41da5c], eax
call fcn.004111d4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x41da60], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x41da68], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040f858
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov edi, dword [esi + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040f8a8
mov dword [esp + 4], 0
mov dword [esp], 0x41da90
call fcn.00410710
test byte [esi + 0x10], 1
je 0x4109b3
mov eax, dword [0x41da68]
nop word cs:[eax + eax]
inc eax
mov cl, byte [eax - 1]
cmp cl, 9
je 0x410998
cmp cl, 0x22
je 0x4109d7
cmp cl, 0x20
je 0x410998
dec eax
mov edx, 0x20
jmp 0x4109ec
mov eax, dword [0x41da74]
mov ecx, dword [0x41da78]
mov edx, dword [0x41da7c]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [esi + 0x18]
jmp 0x410a6f
mov cl, byte [eax]
mov edx, 0x22
jmp 0x4109ec
mov cl, byte [eax + 1]
inc eax
xor ch, ch
test cl, cl
je 0x410a00
cmp cl, 9
je 0x4109fe
movsx edi, cl
cmp edi, edx
jne 0x4109e8
mov ch, cl
lea edi, [eax + 1]
cmp ch, 0x22
cmovne edi, eax
jmp 0x410a19
inc edi
mov al, byte [edi]
cmp al, 9
je 0x410a18
cmp al, 0x20
je 0x410a18
mov ebx, dword [esi + 0x18]
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
mov eax, 0xa
test byte [esp + 0x44], 1
je 0x410a57
movzx eax, word [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], 0
call ebx
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0040f674
add esp, 0x5c
pop esi
pop edi
pop ebx
ret
Function at 0x4059a8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x260]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00408c28
lea ecx, [0x413838]
lea edx, [ebp - 0x260]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x268], eax
call fcn.00404c18
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, esp
mov dword [esi + 8], ecx
mov dword [esi], edx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [ebp - 0x26c], eax
call sub.KERNEL32.DLL_FindFirstFileExA
sub esp, 0x18
mov ecx, 0xffffffff
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], ecx
jne 0x405a5a
mov dword [ebp - 0xc], 0
jmp 0x405bdb
mov dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x15c]
and eax, 0x10
cmp eax, 0
je 0x405b91
lea eax, [0x41383a]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00408bd8
cmp eax, 0
je 0x405b8f
lea eax, [0x41383c]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00408bd8
cmp eax, 0
je 0x405b8f
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c28
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
add ecx, 0x2c
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x270], eax
call fcn.00404c18
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [ebp - 0x274], eax
call esi
cmp eax, 0
jne 0x405b36
jmp 0x405bba
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x14], 0
je 0x405b8d
mov eax, 1
lea ecx, [ebp - 0x260]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [ebp - 0x278], eax
call fcn.004059a8
mov ecx, dword [ebp - 0x264]
add ecx, eax
mov dword [ebp - 0x264], ecx
jmp 0x405b8f
jmp 0x405b91
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_FindNextFileA
sub esp, 8
cmp eax, 0
jne 0x405bb5
jmp 0x405bba
jmp 0x405a64
mov eax, dword [ebp - 0x160]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_FindClose
sub esp, 4
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0xc]
add esp, 0x28c
pop esi
pop edi
pop ebp
ret
Function at 0x405be8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x100
mov dword [eax], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x12c], eax
call fcn.00405058
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x120]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
sub esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
ja 0x405c6e
mov dword [ebp - 0x10], 0
jmp 0x405db0
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call fcn.00406488
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 0x18]
mov esi, esp
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi], ecx
mov dword [esi + 4], 0
call sub.VERSION.DLL_GetFileVersionInfoA
sub esp, 0x10
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x18]
lea esi, [ebp - 0x120]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], ecx
mov dword [edi], edx
mov dword [edi + 4], 0x413840
mov dword [ebp - 0x130], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x405d13
cmp dword [ebp - 0x120], 4
jne 0x405d13
mov eax, dword [ebp - 0x11c]
movzx eax, word [eax]
shl eax, 0x10
mov ecx, dword [ebp - 0x11c]
movzx ecx, word [ecx + 2]
or eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x405d1d
mov dword [ebp - 0x124], 0x40904e4
lea eax, [0x413859]
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040a354
lea ecx, [ebp - 0x11c]
lea edx, [ebp - 0x118]
mov esi, dword [ebp - 0x18]
lea edi, [ebp - 0x120]
mov ebx, esp
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [ebx], esi
mov dword [ebp - 0x134], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x405d9c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408c28
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00406498
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret