joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588b36
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x44
push 0
lea eax, [ebp - 0xa4]
push eax
call fcn.0049e690
add esp, 0xc
mov dword [ebp - 0xa4], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.0049e690
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.00403660
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00403660
mov byte [ebp - 4], 1
cmp dword [ebp + 0xc], 0
je 0x41e6d5
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004036d0
lea ecx, [ebp - 0x2c]
call fcn.004037b0
movzx eax, al
test eax, eax
je 0x41e6f2
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004036d0
jmp 0x41e724
push 0x5953b4
lea ecx, [ebp - 0x48]
call fcn.004036d0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x48]
call fcn.00403850
push 0x5953b8
lea ecx, [ebp - 0x48]
call fcn.00403850
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00404020
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0xa4]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x48]
call fcn.00401670
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41e77d
mov dword [ebp - 0xa8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401640
mov eax, dword [ebp - 0xa8]
jmp 0x41e7f0
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41e7b1
cmp dword [ebp + 0x14], 0
jle 0x41e796
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xb0], ecx
jmp 0x41e7a0
mov dword [ebp - 0xb0], 0xffffffff
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401640
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x41e9c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x838]
push eax
call fcn.0049e690
add esp, 0xc
mov dword [ebp - 0x838], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7ec]
push ecx
call fcn.0049e690
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x5953cc
lea eax, [ebp - 0x7d8]
push eax
call fcn.0042abe0
add esp, 0xc
lea ecx, [ebp - 0x7ec]
push ecx
lea edx, [ebp - 0x838]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41ea4a
jmp 0x41ea87
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x7ec]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x7dc]
push edx
mov eax, dword [ebp - 0x7ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x7ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x41f8e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588ba9
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x41f918
xor eax, eax
jmp 0x41fa88
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401600
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
push ecx
call fcn.00422dc0
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x264], 0
push 0x228
push 0
lea edx, [ebp - 0x260]
push edx
call fcn.0049e690
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x41f99b
mov dword [ebp - 0x284], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401640
mov eax, dword [ebp - 0x284]
jmp 0x41fa88
mov dword [ebp - 0x264], 0x22c
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41fa5f
lea edx, [ebp - 0x240]
push edx
lea ecx, [ebp - 0x280]
call fcn.00401600
mov byte [ebp - 4], 1
lea eax, [ebp - 0x280]
push eax
call fcn.00422dc0
add esp, 4
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x280]
push edx
call fcn.00419a10
add esp, 8
movzx eax, al
test eax, eax
je 0x41fa38
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x288], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x280]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401640
mov eax, dword [ebp - 0x288]
jmp 0x41fa88
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x280]
call fcn.00401640
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41f9bd
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401640
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x421410
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 1
test eax, eax
je 0x4214a1
mov word [ebp - 0x218], 0
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0049e690
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421471
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42148c
jmp 0x4214a1
cmp dword [ebp - 8], 0xa
jl 0x421496
xor eax, eax
jmp 0x4214a6
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x421431
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x4214c0
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.0049e690
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0049e690
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0049eb52
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0049eb52
add esp, 8
lea eax, [ebp - 0x418]
push eax
call fcn.004a1a95
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
call fcn.004a1a95
add esp, 4
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0049e720
add esp, 8
test eax, eax
jne 0x421574
jmp 0x4216a0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421587
jmp 0x4216a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x41c], 0
mov edx, 1
test edx, edx
je 0x4216a0
mov word [ebp - 0x628], 0
push 0x206
push 0
lea eax, [ebp - 0x626]
push eax
call fcn.0049e690
add esp, 0xc
cmp dword [ebp - 0x41c], 0
jne 0x4215e7
mov ecx, dword [ebp + 0xc]
push ecx
push 0x595b58
lea edx, [ebp - 0x628]
push edx
call fcn.0042abe0
add esp, 0xc
jmp 0x421606
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x595b68
lea edx, [ebp - 0x628]
push edx
call fcn.0042abe0
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421624
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x628]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a1b20
add esp, 8
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421670
push 5
push 0
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x4216a0
push 5
push 0
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x41c], 0xa
jl 0x42168c
jmp 0x4216a0
mov eax, dword [ebp - 0x41c]
add eax, 1
mov dword [ebp - 0x41c], eax
jmp 0x421598
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x4219e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa88
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4219fe
jmp 0x421b5a
mov eax, dword [ebp + 8]
push eax
push 0x595bd0
lea ecx, [ebp - 0x418]
push ecx
call fcn.0042abe0
add esp, 0xc
lea edx, [ebp - 0x670]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0xffffffff
je 0x421b41
lea ecx, [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x674]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x421a65
jmp 0x421b41
movzx eax, word [ebp - 0x644]
cmp eax, 0x2e
jne 0x421a73
jmp 0x421a30
movzx ecx, word [ebp - 0x642]
test ecx, ecx
jne 0x421a80
jmp 0x421a30
movzx edx, word [ebp - 0x642]
cmp edx, 0x2e
jne 0x421a99
movzx eax, word [ebp - 0x640]
test eax, eax
jne 0x421a99
jmp 0x421a30
lea ecx, [ebp - 0x644]
push ecx
push 0x595bdc
lea edx, [ebp - 0x210]
push edx
call fcn.0042abe0
add esp, 0xc
mov eax, dword [ebp - 0x670]
and eax, 0x10
je 0x421b0e
mov word [ebp - 0x880], 0
push 0x206
push 0
lea ecx, [ebp - 0x87e]
push ecx
call fcn.0049e690
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x595be4
lea ecx, [ebp - 0x880]
push ecx
call fcn.0042abe0
add esp, 0x10
lea edx, [ebp - 0x880]
push edx
call fcn.004219e0
add esp, 4
jmp 0x421b3c
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x595bf0
lea edx, [ebp - 0xa88]
push edx
call fcn.0042abe0
add esp, 0x10
lea eax, [ebp - 0xa88]
push eax
call fcn.004221b0
add esp, 4
jmp 0x421a30
mov ecx, dword [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
call fcn.004221b0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x421f60
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589040
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403680
mov byte [ebp - 4], 1
push 0x595c10
lea ecx, [ebp - 0x2c]
call fcn.00403850
lea ecx, [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401670
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
je 0x422127
lea edx, [ebp - 0x284]
push edx
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x421ffa
jmp 0x422127
movzx ecx, word [ebp - 0x258]
cmp ecx, 0x2e
jne 0x422008
jmp 0x421fcb
movzx edx, word [ebp - 0x256]
test edx, edx
jne 0x422015
jmp 0x421fcb
movzx eax, word [ebp - 0x256]
cmp eax, 0x2e
jne 0x42202e
movzx ecx, word [ebp - 0x254]
test ecx, ecx
jne 0x42202e
jmp 0x421fcb
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.00401600
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x284]
and eax, 0x10
je 0x4220ba
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x2c0]
call fcn.00403680
mov byte [ebp - 4], 3
lea edx, [ebp - 0x2a4]
push edx
lea ecx, [ebp - 0x2c0]
call fcn.00404020
push 0x595c18
lea ecx, [ebp - 0x2c0]
call fcn.00403850
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e0], esp
lea eax, [ebp - 0x2c0]
push eax
call fcn.00403680
mov dword [ebp - 0x2e8], eax
call fcn.00421f60
add esp, 0x1c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c0]
call fcn.00401640
jmp 0x422113
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x2dc]
call fcn.00403680
mov byte [ebp - 4], 4
lea edx, [ebp - 0x2a4]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.00404020
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2e4], esp
lea eax, [ebp - 0x2dc]
push eax
call fcn.00403680
mov dword [ebp - 0x2ec], eax
call fcn.004221e0
add esp, 0x1c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2dc]
call fcn.00401640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a4]
call fcn.00401640
jmp 0x421fcb
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call fcn.00401670
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x422166
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401640
jmp 0x422194
push 4
push 0
lea ecx, [ebp + 8]
call fcn.00401670
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x4221e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589070
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5f44b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401670
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42223f
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401640
mov eax, dword [ebp - 0x18]
jmp 0x422269
lea ecx, [ebp + 8]
call fcn.00401670
push eax
call fcn.00421b70
add esp, 4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401640
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x423ce0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
push 0
lea ecx, [ebp - 0x150]
push ecx
call fcn.0049e690
add esp, 0xc
mov dword [ebp - 0x150], 0x11c
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], 5
jg 0x423d4f
cmp dword [ebp - 8], 2
jg 0x423d4f
mov eax, 1
jmp 0x423d51
xor eax, eax
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x424e80
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1620
call fcn.004a04d0
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x9e8], 0
push 0x206
push 0
lea eax, [ebp - 0x9e6]
push eax
call fcn.0049e690
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x595ee8
lea edx, [ebp - 0x9e8]
push edx
call fcn.0042abe0
add esp, 0xc
lea eax, [ebp - 0x9e8]
push eax
call fcn.0049e752
add esp, 4
mov dword [ebp - 0x7dc], eax
mov ecx, dword [ebp - 0x7dc]
sub ecx, 1
test ecx, ecx
jle 0x424f13
mov edx, dword [ebp - 0x7dc]
movzx eax, word [ebp + edx*2 - 0x9ea]
cmp eax, 0x5c
je 0x424f13
mov ecx, dword [ebp - 0x7dc]
mov word [ebp + ecx*2 - 0x9e8], 0x5c
lea edx, [ebp - 0x9e8]
push edx
push 0x595ef0
lea eax, [ebp - 0x7d8]
push eax
call fcn.0042abe0
add esp, 0xc
lea ecx, [ebp - 0xc40]
push ecx
lea edx, [ebp - 0x7d8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc44], eax
cmp dword [ebp - 0xc44], 0xffffffff
je 0x425040
lea eax, [ebp - 0xc40]
push eax
mov ecx, dword [ebp - 0xc44]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x9ec], 0
jne 0x424f7d
jmp 0x425040
movzx edx, word [ebp - 0xc14]
cmp edx, 0x2e
jne 0x424f8b
jmp 0x424f48
movzx eax, word [ebp - 0xc12]
test eax, eax
jne 0x424f98
jmp 0x424f48
movzx ecx, word [ebp - 0xc12]
cmp ecx, 0x2e
jne 0x424fb1
movzx edx, word [ebp - 0xc10]
test edx, edx
jne 0x424fb1
jmp 0x424f48
mov eax, dword [ebp - 0xc40]
and eax, 0x10
je 0x42500c
mov word [ebp - 0x1620], 0
push 0x206
push 0
lea ecx, [ebp - 0x161e]
push ecx
call fcn.0049e690
add esp, 0xc
lea edx, [ebp - 0xc14]
push edx
lea eax, [ebp - 0x9e8]
push eax
push 0x595efc
lea ecx, [ebp - 0x1620]
push ecx
call fcn.0042abe0
add esp, 0x10
lea edx, [ebp - 0x1620]
push edx
call fcn.00424e80
add esp, 4
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0x9e8]
push ecx
push 0x595f08
lea edx, [ebp - 0x1418]
push edx
call fcn.0042abe0
add esp, 0x10
lea eax, [ebp - 0x1418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x424f48
mov ecx, dword [ebp - 0xc44]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0xc44], 0xffffffff
push 0x20
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x425080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1410
call fcn.004a04d0
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x595f14
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.0042abe0
add esp, 0xc
lea edx, [ebp - 0xa30]
push edx
lea eax, [ebp - 0x7d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 0xffffffff
je 0x4251b8
lea ecx, [ebp - 0xa30]
push ecx
mov edx, dword [ebp - 0xa34]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0
jne 0x4250fe
jmp 0x4251b8
movzx eax, word [ebp - 0xa04]
cmp eax, 0x2e
jne 0x42510c
jmp 0x4250c9
movzx ecx, word [ebp - 0xa02]
test ecx, ecx
jne 0x425119
jmp 0x4250c9
movzx edx, word [ebp - 0xa02]
cmp edx, 0x2e
jne 0x425132
movzx eax, word [ebp - 0xa00]
test eax, eax
jne 0x425132
jmp 0x4250c9
mov word [ebp - 0x1410], 0
push 0x206
push 0
lea ecx, [ebp - 0x140e]
push ecx
call fcn.0049e690
add esp, 0xc
lea edx, [ebp - 0xa04]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x595f20
lea ecx, [ebp - 0x1208]
push ecx
call fcn.0042abe0
add esp, 0x10
lea edx, [ebp - 0x1410]
push edx
lea eax, [ebp - 0xa04]
push eax
call fcn.00420a60
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1410]
push edx
call fcn.0049e720
add esp, 8
test eax, eax
jne 0x4251ae
lea eax, [ebp - 0x1208]
push eax
call fcn.00421b70
add esp, 4
jmp 0x4251b3
jmp 0x4250c9
jmp 0x4250c9
mov ecx, dword [ebp - 0xa34]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret
Function at 0x425ab0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x425bfa
lea eax, [ebp - 0xc]
push eax
push 0x5a1da0
push 1
push 0
push 0x5a1db0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x425bf4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x50]
call edx
cmp dword [ebp + 0x10], 0
je 0x425b21
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
cmp dword [ebp + 0x18], 0
je 0x425b39
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x3c]
call eax
movzx ecx, word [ebp + 0x1c]
test ecx, ecx
je 0x425b54
mov dx, word [ebp + 0x1c]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x34]
call eax
cmp dword [ebp + 0x14], 0
je 0x425b6e
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x44]
call edx
cmp dword [ebp + 0x20], 0
je 0x425b86
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x24]
call ecx
cmp dword [ebp + 0x24], 0
je 0x425b9e
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x2c]
call eax
lea ecx, [ebp - 0x10]
push ecx
push 0x5a1df0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x425be6
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret