joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fbd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f20b
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x4a4a28]
xor eax, esp
mov dword [esp + 0x254], eax
push ebp
push esi
push edi
mov eax, dword [0x4a4a28]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
or edi, 0xffffffff
cmp word [eax], 0
je 0x41fd89
push eax
lea ecx, [esp + 0x14]
call fcn.00404a50
mov dword [esp + 0x274], 0
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 0xc]
lea esi, [eax + 0x104]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x41fc5f
push esi
lea ecx, [esp + 0x14]
call fcn.004047c0
mov edx, dword [esp + 0x10]
push 0x490b40
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x41fc77
xor eax, eax
jmp 0x41fc95
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41fc80
sub eax, esi
sar eax, 1
js 0x41fdb4
cmp eax, dword [edx - 8]
jg 0x41fdb4
mov dword [edx - 0xc], eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov word [ecx + eax*2], 0
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41fd5e
xor edi, edi
test byte [esp + 0x14], 0x10
je 0x41fd3f
lea ecx, [esp + 0x40]
push 0x48df2c
push ecx
call fcn.0046765d
add esp, 8
test eax, eax
je 0x41fd3f
lea edx, [esp + 0x40]
push 0x490b48
push edx
call fcn.0046765d
add esp, 8
test eax, eax
je 0x41fd3f
cmp word [esp + 0x40], 0x5f
je 0x41fd3f
xor eax, eax
mov esi, 0x490b10
lea ebx, [ebx]
mov ecx, dword [esi]
test ecx, ecx
je 0x41fd32
push ecx
lea eax, [esp + 0x44]
push eax
call fcn.0046765d
add esp, 8
neg eax
sbb eax, eax
add eax, 1
add esi, 0x10
test eax, eax
je 0x41fd10
xor ecx, ecx
test eax, eax
setne cl
lea ecx, [ecx + ecx - 1]
mov edi, ecx
test edi, edi
jl 0x41fd57
lea edx, [esp + 0x14]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41fcc8
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x274], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fd89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.00467769
add esp, 0x268
ret 4
push 0x80070057
call fcn.00402720
int3
Function at 0x420cd0
Capabilities:
Create directory
Create process on windows
Get common file path
Log keystrokes via polling
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x418
mov eax, dword [0x4a4a28]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
call fcn.0044bc48
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x68]
mov dword [esi], eax
call fcn.0044bc48
mov ecx, dword [eax + 4]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [ecx + 0x68], 0
call esi
test ax, ax
jge 0x420dff
push 0x11
call esi
test ax, ax
jge 0x420dff
push 1
push 0x23
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x420dff
push str.Epson
lea eax, [esp + 0xc]
call fcn.004254d0
add esp, 4
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x490d68
lea eax, [esp + 0xc]
call fcn.004254d0
add esp, 4
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x420dff
push 0
lea edx, [esp + 8]
push edx
push 2
push 0x48cd14
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044bc48
mov esi, dword [eax + 4]
lea eax, [esp + 8]
push eax
call fcn.00468352
add esp, 4
push 0
push 0x24
push str.Do_you_want_to_open_the_folder_
mov dword [esi + 0x68], eax
call fcn.0044b320
cmp eax, 6
jne 0x420dff
push edi
lea edi, [esp + 0xc]
call fcn.00425390
push 7
push 0
push 0
mov ecx, edi
push ecx
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
mov ecx, dword [esp + 0x418]
pop esi
xor ecx, esp
call fcn.00467769
add esp, 0x418
ret
Function at 0x4218f0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f178
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4a4a28]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
call fcn.0044bc48
mov eax, dword [eax + 4]
cmp dword [eax + 0x68], 0
je 0x421a4c
call fcn.0044bc48
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x68]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x421a4c
call fcn.00442c05
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x421971
push 0x80004005
call fcn.00402720
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x3c]
mov eax, dword [edx]
movzx ecx, word [esp + 0x26]
movzx edx, word [esp + 0x24]
push 0x48cd24
push eax
movzx eax, word [esp + 0x2a]
push ecx
movzx ecx, word [esp + 0x2c]
push edx
movzx edx, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x2e]
push ecx
movzx ecx, word [esp + 0x30]
push edx
push eax
push ecx
lea edx, [esp + 0x34]
push str._04d__02d__02d__02d:_02d:_02d__03d_____s_s
push edx
call fcn.004048d0
add esp, 0x2c
push 2
push 0
push 0
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
cmp dword [esi - 4], 1
mov ebx, dword [esi - 0xc]
jle 0x421a0e
mov eax, ebx
push eax
lea ecx, [esp + 0x14]
call fcn.00404810
mov esi, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [ebx + ebx]
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov dword [esp + 0x34], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421a4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x421a60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
push str.GetValue
call fcn.00420e20
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 8
xor esi, esi
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call ebp
test eax, eax
jne 0x421af8
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x421af8
add eax, 2
push eax
mov dword [esp + 0x10], eax
call fcn.0044288b
add esp, 4
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push edi
push ebx
mov dword [esp + 0x28], 0
call ebp
test eax, eax
jne 0x421af8
cmp dword [esp + 0x10], 1
jne 0x421add
mov ecx, dword [esp + 0xc]
mov word [ecx + esi], ax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x421aeb
mov edx, dword [esp + 0x10]
mov dword [eax], edx
cmp dword [esp + 0x1c], 0
je 0x421af8
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov edx, dword [esp + 0x10]
push edx
push str.Type
call fcn.00421520
mov eax, dword [esp + 0x14]
push eax
push str.DataSize
call fcn.00421520
add esp, 0x10
cmp dword [esp + 0x10], 1
jne 0x421b3a
push str.GetValue
push str.String
call fcn.00421090
add esp, 8
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
push esi
push str.GetValue
push str.CRegistryIF
call fcn.00421310
add esp, 0xc
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x421cb0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
push edi
push str.SetStringValue
mov ebx, ecx
call fcn.00420e20
push 0
push 0
call fcn.00421a60
push edi
push str.DeleteEntry
mov esi, eax
call fcn.00420e20
add esp, 0x18
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push str.DeleteEntry
push str.CRegistryIF
call fcn.00421170
add esp, 0xc
test esi, esi
je 0x421d08
push esi
call fcn.00442886
add esp, 4
mov eax, ebp
call fcn.00439bd0
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
push str.SetStringValue
push str.CRegistryIF
call fcn.00421170
add esp, 0xc
pop edi
xor eax, eax
test esi, esi
pop esi
pop ebp
sete al
pop ebx
ret

Function at 0x421d50
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push edi
push str.SetBinaryValue
mov ebx, ecx
call fcn.00420e20
push 0
push 0
call fcn.00421a60
push edi
push str.DeleteEntry
mov esi, eax
call fcn.00420e20
add esp, 0x18
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
push str.DeleteEntry
push str.CRegistryIF
call fcn.00421170
add esp, 0xc
test esi, esi
je 0x421da3
push esi
call fcn.00442886
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 4
push eax
push ecx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
push str.SetBinaryValue
push str.CRegistryIF
call fcn.00421170
add esp, 0xc
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
ret
Function at 0x422610
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x47ffd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a4a28]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.GetInternetConnectionStatus
push str.CWinInternetConnect
call fcn.00420ef0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
add esp, 8
mov dword [esp + 0x24], 1
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call ebp
mov dword [esp + 0x28], eax
push esi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4226e8
test byte [esp + 0x18], 2
je 0x4226e8
push ebx
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x4226e8
push eax
push eax
push eax
push eax
push str.InstallNavi_Agent.epson.co.jp
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x4226e8
call ebp
push ebx
push 0x200
push ebx
push ebx
push str.http:__www.epson.com_
push edi
mov dword [esp + 0x38], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
test ebx, ebx
je 0x4226d9
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x24], 2
call ebp
mov esi, eax
sub esi, dword [esp + 0x20]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call ebp
mov ebp, eax
sub ebp, dword [esp + 0x28]
call fcn.00442c05
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42270a
push 0x80004005
call fcn.00402720
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
push esi
push ebp
push ebx
push edi
push ecx
mov dword [esp + 0x4c], 0
mov edx, dword [esp + 0x2c]
push edx
push eax
lea ecx, [esp + 0x3c]
push str.result_ld__state_lx__error_ld__hinet_p__hRequest_p__ftime_ld__ctime_ld
push ecx
call fcn.004048d0
mov esi, dword [esp + 0x44]
add esp, 0x24
push str.GetInternetConnectionStatus
call fcn.00421450
mov edi, dword [esp + 0x28]
add esp, 4
push edi
push str.GetInternetConnectionStatus
push str.CWinInternetConnect
call fcn.00421170
lea eax, [esi - 0x10]
add esp, 0xc
mov dword [esp + 0x38], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422793
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x426ce0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x120
mov eax, dword [0x4a4a28]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebp
mov ebp, dword [esp + 0x128]
push esi
push 0x100
call fcn.0044288b
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x426e35
cmp byte [esi + 0x11], 0
jge 0x426e35
push 0x11c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004692d0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esi + 0x30], 0
mov eax, 5
lea edx, [eax - 3]
lea ecx, [eax - 4]
jl 0x426dac
cmp byte [esi + 0x60], 0
jl 0x426dac
cmp byte [esi + 0x31], 0
jl 0x426da4
cmp byte [esi + 0x61], 0
jl 0x426da4
cmp byte [esi + 0x32], 0
jl 0x426d9c
cmp byte [esi + 0x62], 0
jl 0x426d9c
cmp byte [esi + 0x33], 0
jl 0x426d93
cmp byte [esi + 0x63], 0
jl 0x426d93
cmp byte [esi + 0x34], 0
jl 0x426d93
cmp byte [esi + 0x64], 0
jge 0x426db6
mov dword [edi + 4], 6
jmp 0x426daf
mov dword [edi + 4], eax
mov dword [edi + 8], edx
jmp 0x426db6
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
jmp 0x426db6
mov dword [edi + 4], eax
mov dword [edi + 8], 0
cmp byte [esi + 0x38], 0
jl 0x426dd7
cmp byte [esi + 0x68], 0
jl 0x426dd7
cmp byte [esi + 0x39], 0
jl 0x426dce
cmp byte [esi + 0x69], 0
jge 0x426ddd
mov byte [edi + 0x11a], 3
jmp 0x426ddd
mov byte [edi + 0x11a], cl
cmp byte [esi + 0x36], 0
jl 0x426e16
cmp byte [esi + 0x66], 0
jl 0x426e16
cmp byte [esi + 0x37], 0
jl 0x426df5
cmp byte [esi + 0x67], 0
jge 0x426e35
mov word [ebp], 9
cmp dword [edi + 4], eax
jne 0x426e35
cmp dword [edi + 8], ecx
jne 0x426e35
cmp dword [esp + 0xc], eax
jne 0x426e35
cmp dword [esp + 0x10], ecx
jne 0x426e35
mov dword [edi + 8], edx
jmp 0x426e35
mov word [ebp], 0
cmp dword [edi + 4], eax
jne 0x426e35
cmp dword [edi + 8], edx
jne 0x426e35
cmp dword [esp + 0xc], eax
jne 0x426e35
cmp dword [esp + 0x10], edx
jne 0x426e35
mov dword [edi + 8], ecx
push esi
call fcn.00442886
mov ecx, dword [esp + 0x128]
add esp, 4
pop esi
pop ebp
xor ecx, esp
call fcn.00467769
add esp, 0x120
ret 4
Function at 0x4280b0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push edi
push 0
push 0
call ebp
mov esi, eax
add esi, 1
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044288b
add esp, 4
mov edi, eax
push edi
push esi
call ebp
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push eax
call esi
push edi
mov ebx, eax
call esi
push edi
call fcn.00442886
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x4284d0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
xor edi, edi
call fcn.0044bc48
mov eax, dword [eax + 8]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa
push 0x66
push eax
call ebp
mov esi, eax
test esi, esi
je 0x4285a2
call fcn.0044bc48
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4285a2
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push eax
call edi
mov ebx, eax
call fcn.0044bc48
mov eax, dword [eax + 8]
push 0xa
push 0x67
push eax
call ebp
mov esi, eax
test esi, esi
je 0x42859a
call fcn.0044bc48
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
mov ebp, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
mov esi, eax
push ebp
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42859a
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x428592
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x428b20
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47fbbb
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x4a4a28]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a4a28]
xor eax, esp
push eax
lea eax, [esp + 0x284]
mov dword fs:[0], eax
mov eax, dword [esp + 0x294]
mov esi, ecx
xor edi, edi
cmp esi, edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
je 0x428ccb
cmp word [esi], di
je 0x428ccb
push esi
lea ecx, [esp + 0x1c]
call fcn.00404a50
lea ecx, [esp + 0x18]
push ecx
mov ebx, str..emi
mov dword [esp + 0x290], edi
call fcn.004285b0
mov eax, dword [esp + 0x1c]
add esp, 4
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x28], edi
je 0x428c9a
mov ecx, dword [esp + 0x2c]
shr ecx, 4
not ecx
test cl, 1
je 0x428c7f
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428be0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.00404e80
lea edx, [esp + 0x18]
push edx
lea ebx, [esp + 0x5c]
call fcn.004285b0
mov eax, dword [esp + 0x1c]
push eax
call fcn.00429010
add esp, 8
test eax, eax
je 0x428c7f
mov ecx, ebx
mov ebx, dword [esp + 0x20]
push ecx
call fcn.00428770
mov ebp, eax
lea eax, [esp + 0x5c]
call fcn.00439bd0
mov esi, eax
add esi, 1
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044288b
add esp, 8
cmp esi, 0x7fffffff
mov edi, eax
ja 0x428c67
lea eax, [esp + 0x58]
mov edx, esi
mov ecx, edi
call fcn.00402c70
push 1
push edi
push ebp
mov ecx, ebx
call fcn.00448bc6
add dword [esp + 0x1c], 1
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x428bc5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x28c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428cc5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
jmp 0x428ccd
xor eax, eax
mov ecx, dword [esp + 0x284]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.00467769
add esp, 0x27c
ret
Function at 0x4293b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x4a4a28]
xor eax, esp
mov dword [esp + 0x268], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
call fcn.00439bd0
mov esi, eax
mov eax, edi
call fcn.00439bd0
lea ebx, [esi + eax + 0x104]
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044288b
add esp, 4
cmp ebx, 0x7fffffff
mov esi, eax
ja 0x429432
mov eax, edi
mov edx, ebx
mov ecx, esi
call fcn.00402c70
mov eax, dword [esp + 0x18]
push eax
mov eax, esi
call fcn.004254d0
add esp, 4
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x4294b9
mov edx, dword [esp + 0x20]
shr edx, 4
not edx
test dl, 1
je 0x42949a
cmp ebx, 0x7fffffff
ja 0x429477
mov eax, edi
mov edx, ebx
mov ecx, esi
call fcn.00402c70
lea eax, [esp + 0x4c]
push eax
mov eax, esi
call fcn.004254d0
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
push esi
push edi
call dword [esp + 0x28]
test eax, eax
je 0x42949a
add dword [esp + 0x10], 1
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x429456
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 0x14]
not edx
test dl, 1
je 0x42959a
cmp ebx, 0x7fffffff
ja 0x4294da
mov eax, edi
mov edx, ebx
mov ecx, esi
call fcn.00402c70
push 0x490b40
mov eax, esi
call fcn.004254d0
add esp, 4
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x42959a
test byte [esp + 0x20], 0x10
je 0x429577
lea ecx, [esp + 0x4c]
push 0x48df2c
push ecx
call fcn.0046765d
add esp, 8
test eax, eax
je 0x429577
lea edx, [esp + 0x4c]
push 0x490b48
push edx
call fcn.0046765d
add esp, 8
test eax, eax
je 0x429577
cmp ebx, 0x7fffffff
ja 0x429548
mov eax, edi
mov edx, ebx
mov ecx, esi
call fcn.00402c70
lea eax, [esp + 0x4c]
push eax
mov eax, esi
call fcn.004254d0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov eax, dword [ebp + 0x14]
push 0
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push esi
push edi
call fcn.004293b0
add esp, 0x20
add dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x429502
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call fcn.00442886
mov ecx, dword [esp + 0x278]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00467769
mov esp, ebp
pop ebp
ret
Function at 0x429ea0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 1
mov ecx, ebp
call fcn.0042a240
mov esi, eax
test esi, esi
jne 0x429f30
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jbe 0x429f30
mov eax, dword [edi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, ebx
or ecx, edx
jge 0x429ee4
push ebx
mov ecx, edi
call fcn.004047c0
mov eax, dword [edi]
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, dword [edi]
test edx, edx
jne 0x429ef9
xor ecx, ecx
jmp 0x429f11
mov ecx, edx
lea ebx, [ecx + 2]
mov edi, edi
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x429f00
sub ecx, ebx
sar ecx, 1
js 0x429f38
cmp ecx, dword [edx - 8]
jg 0x429f38
mov dword [edx - 0xc], ecx
mov edx, dword [edi]
mov word [edx + ecx*2], 0
mov ecx, dword [edi]
mov edx, dword [ecx - 0xc]
add edx, 1
cmp edx, eax
sbb esi, esi
add esi, 1
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
push 0x80070057
call fcn.00402720
int3