joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446cb7
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xe4
mov eax, 0x5d0e71
call fcn.0059d2e0
mov esi, dword [ebp + 8]
mov dword [ebp - 0xe8], esi
mov edi, 0x656858
lea ecx, [ebp - 0x28]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00403040
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 1
call fcn.00456594
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446dfa
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x446d41
push edi
mov ecx, esi
call fcn.00403040
jmp 0x446e17
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xec], eax
inc eax
push eax
mov dword [ebp - 0xe8], eax
call fcn.0059cf3d
mov edi, eax
pop ecx
test edi, edi
jne 0x446d6b
push 0x656858
jmp 0x446d35
push dword [ebp - 0xe8]
push 0
push edi
call fcn.005a2240
add esp, 0xc
lea eax, [ebp - 0xf0]
push 0
push eax
push dword [ebp - 0xec]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xec]
lea ecx, [ebp - 0xe4]
push edi
call fcn.00456f4e
push edi
call fcn.0059cf46
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xe4]
call fcn.0045679f
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.00444031
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00403100
cmp dword [ebp - 0x30], 0
jbe 0x446df0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00417a80
lea ecx, [ebp - 0x40]
call fcn.00402fe0
xor ebx, ebx
mov byte [ebp - 0xe8], bl
lea eax, [ebp - 0x28]
push dword [ebp - 0xe8]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.0043e8c2
lea ecx, [ebp - 0x28]
call fcn.00402fe0
lea ecx, [ebp + 0xc]
call fcn.00402fe0
mov eax, esi
call fcn.0059d28a
ret
Function at 0x446e2f
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x667ce0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.005a2240
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005a2240
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.005afda6
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.005afda6
lea eax, [ebp - 0x61c]
push eax
call fcn.005afc92
lea eax, [ebp - 0x414]
push eax
call fcn.005afc92
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.005afd66
add esp, 0x38
test eax, eax
je 0x446f8d
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x446f8d
xor esi, esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005a2240
add esp, 0xc
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x446f0d
push str..cdc
push edi
push 0x5d82b8
push eax
call fcn.00405d80
add esp, 0x10
jmp 0x446f22
push esi
push str..cdc
push edi
push str._s_s_d
push eax
call fcn.00405d80
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
je 0x446f3c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.005afadc
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
lea eax, [ebp - 0x20c]
push 0
push eax
jne 0x446f87
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp esi, 0xa
jge 0x446f8d
inc esi
jmp 0x446ed7
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059cf09
leave
ret

Function at 0x446f9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push 0x80
push 2
push esi
inc edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x446fcb
xor eax, eax
jmp 0x446ff9
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x446ff5
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x446ff7
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447d9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
je 0x447e47
push ebx
push esi
push edi
xor ebx, ebx
push str.b69749abbfffc7f6494ec5c0eb4c7d2c
mov dword [ebp - 4], ebx
call fcn.005afdf0
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
call fcn.0059cf3d
push edi
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.005a1740
add esp, 0x14
mov edx, ebx
test edi, edi
je 0x447df7
mov ecx, ebx
mov al, byte [ecx + str.b69749abbfffc7f6494ec5c0eb4c7d2c]
xor byte [edx + esi], al
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 8]
cmovge ecx, eax
inc edx
cmp edx, edi
jb 0x447de0
cmp edi, 1
jle 0x447e19
cmp byte [esi], 0x37
jne 0x447e19
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x447e0c
cmp al, 0x5a
jne 0x447e19
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.00593750
mov ebx, eax
push esi
call fcn.0059cf46
pop ecx
test ebx, ebx
je 0x447e37
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x447e37
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x447e44
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448b9a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.005afdc8
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0059cf3d
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.005afda6
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x448c14
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x448c0b
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x448c01
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x448c12
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x448bde
jmp 0x448c14
xor edi, edi
push esi
call fcn.0059cf46
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448c22
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push 0x2b8
mov eax, 0x5d1139
call fcn.0059d2e0
mov esi, dword [ebp + 8]
push esi
call fcn.005afdc8
pop ecx
cmp eax, 3
jb 0x448e25
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x448e25
push esi
lea ecx, [ebp - 0x28]
call fcn.00403040
lea eax, [ebp - 0x28]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004436bb
mov ebx, 0x5d4964
pop ecx
test eax, eax
jne 0x448c85
push ebx
call fcn.005afdc8
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405a30
xor eax, eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
call fcn.0043e95c
mov esi, 0x5d66d4
mov byte [ebp - 4], 2
push esi
call fcn.005afdc8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x70]
call fcn.00405a30
cmp dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x2c0]
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x448de0
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x448de0
push 0x2e
pop eax
cmp word [ebp - 0x294], ax
je 0x448ce9
cmp word [ebp - 0x292], 0
je 0x448ce9
cmp word [ebp - 0x292], ax
jne 0x448d28
cmp word [ebp - 0x290], 0
je 0x448ce9
test byte [ebp - 0x2c0], 0x10
lea eax, [ebp - 0x28]
push eax
je 0x448d98
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call fcn.0043e95c
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 3
push eax
call fcn.005afdc8
pop ecx
push eax
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x40]
call fcn.00405a30
push ebx
call fcn.005afdc8
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00405a30
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00448c22
pop ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402fe0
jmp 0x448ce9
lea ecx, [ebp - 0x58]
call fcn.00417a80
lea eax, [ebp - 0x294]
push eax
call fcn.005afdc8
pop ecx
push eax
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x58]
call fcn.00405a30
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00403040
call fcn.0044a243
add esp, 0x18
jmp 0x448ce9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x70]
call fcn.00402fe0
lea ecx, [ebp - 0x58]
call fcn.00402fe0
lea ecx, [ebp - 0x28]
call fcn.00402fe0
call fcn.0059d28a
ret
Function at 0x448e2b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x667ce0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x1a
push eax
push 0
call fcn.00449fb9
lea eax, [ebp - 0x20c]
push eax
call fcn.005afdc8
add esp, 0x14
test eax, eax
je 0x448ed6
push ebx
mov ebx, 0x5d4964
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005afd35
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005afd35
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005afd35
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x448eba
lea eax, [ebp - 0x20c]
push eax
call fcn.00448b9a
pop ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.005afdc8
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00403240
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0059cf09
leave
ret
Function at 0x4497d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x667ce0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x669474]
test bl, bl
jne 0x44986f
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005a2240
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x449869
lea eax, [ebp - 0x20c]
push eax
call fcn.005afc92
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5db3fc
push eax
call fcn.005a2727
pop ecx
pop ecx
test eax, eax
jne 0x449861
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.005a2727
pop ecx
pop ecx
test eax, eax
je 0x449869
mov byte [0x669474], bl
jmp 0x44986f
mov bl, byte [0x669474]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0059cf09
leave
ret

Function at 0x44987e
Capabilities:
Get common file path

Disassembly:
push 0x138
mov eax, 0x5d120a
call fcn.0059d2e0
mov al, byte [0x669475]
test al, al
jne 0x44992f
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.005a2240
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x44992a
push str.config_systemprofile
lea ecx, [ebp - 0x144]
call fcn.00403210
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x12c]
call fcn.00403210
push esi
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00444575
movzx ecx, byte [0x669475]
cmp eax, 0xffffffff
cmovne ecx, edi
mov byte [0x669475], cl
lea ecx, [ebp - 0x12c]
call fcn.00403100
lea ecx, [ebp - 0x144]
call fcn.00403100
mov al, byte [0x669475]
call fcn.0059d28a
ret
Function at 0x449935
Capabilities:
Check if file exists

Disassembly:
push 0xc50
mov eax, 0x5d123d
call fcn.0059d2e0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc40]
mov ebx, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0xc5c], edi
call fcn.005a2240
push esi
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.005a2240
push esi
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.005a2240
push esi
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.005a2240
push esi
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005a2240
push esi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.005a2240
xor ecx, ecx
mov dword [ebp - 0xc44], 7
xor eax, eax
mov dword [ebp - 0xc48], ecx
add esp, 0x48
mov word [ebp - 0xc58], ax
push ecx
push 0x1a
lea eax, [ebp - 0xc40]
mov dword [ebp - 4], ecx
push eax
push ecx
call fcn.00449fb9
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005afda6
lea eax, [ebp - 0x218]
push eax
call fcn.005afdc8
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.005a29a3
add esp, 0x24
test eax, eax
je 0x449b4a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.005afda6
lea eax, [ebp - 0x830]
push 0x5db3c4
push eax
call fcn.005afd35
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
xor esi, esi
inc ecx
test eax, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
cmovne esi, ecx
push eax
call fcn.005afda6
lea eax, [ebp - 0x628]
push 0x5db3d4
push eax
call fcn.005afd35
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xc5c], ecx
push eax
call fcn.005afda6
lea eax, [ebp - 0xa38]
push 0x5db3e8
push eax
call fcn.005afd35
add esp, 0x10
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x449b4a
cmp dword [ebp - 0xc5c], 0
je 0x449b4a
test ecx, ecx
je 0x449b4a
push ebx
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push 0x5d6c98
push eax
call fcn.00405d80
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x449b28
lea eax, [ebp - 0x420]
push eax
call fcn.00448b9a
pop ecx
lea eax, [ebp - 0x420]
push eax
call fcn.005afdc8
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc58]
call fcn.00403240
jmp 0x449b59
lea eax, [ebp - 0xc58]
push ebx
push eax
call fcn.00448e2b
pop ecx
pop ecx
xor eax, eax
mov ecx, edi
mov byte [ebp - 0xc5c], al
push dword [ebp - 0xc5c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
lea eax, [ebp - 0xc58]
push eax
call fcn.0043e8c2
lea ecx, [ebp - 0xc58]
call fcn.00402fe0
mov eax, edi
call fcn.0059d28a
ret
Function at 0x449b8e
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x2b4
mov eax, 0x5d1285
call fcn.0059d2e0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp + 0xc]
push eax
call fcn.00403040
lea eax, [ebp - 0x58]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004436bb
pop ecx
test eax, eax
jne 0x449bd5
mov esi, 0x5d4964
push esi
call fcn.005afdc8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00405a30
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], ebx
call fcn.0043e95c
mov esi, 0x5d66d4
mov byte [ebp - 4], 1
push esi
call fcn.005afdc8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00405a30
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x2c0]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x449cd6
test byte [ebp - 0x2c0], 0x10
je 0x449cb9
cmp word [ebp - 0x294], 0x2e
je 0x449cb9
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x70]
call fcn.00403040
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.004447b3
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00402fe0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x18], ebx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], ebx
call fcn.0043e95c
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 3
push eax
call fcn.005afdc8
pop ecx
push eax
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405a30
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00449b8e
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402fe0
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x449c25
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x40]
call fcn.00402fe0
lea ecx, [ebp - 0x58]
call fcn.00402fe0
call fcn.0059d28a
ret
Function at 0x44a088
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a0
mov eax, 0x5cbf38
call fcn.0059d2e0
xor edi, edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
call fcn.0043e95c
mov esi, 0x5d66d4
mov byte [ebp - 4], 1
push esi
call fcn.005afdc8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00405a30
push 8
pop ebx
cmp dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44a1fd
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x44a1fd
push 0x2e
pop eax
cmp word [ebp - 0x27c], ax
je 0x44a0ee
cmp word [ebp - 0x27a], 0
je 0x44a0ee
cmp word [ebp - 0x27a], ax
jne 0x44a12d
cmp word [ebp - 0x278], 0
je 0x44a0ee
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00403040
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push eax
je 0x44a1a9
call fcn.0043e95c
cmp dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.00405a30
push 0x5d4964
call fcn.005afdc8
pop ecx
push eax
push 0x5d4964
lea ecx, [ebp - 0x28]
call fcn.00405a30
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0043e95c
call fcn.0044a088
jmp 0x44a1e1
call fcn.0043e95c
cmp dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 4
call fcn.00405a30
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0043e95c
call fcn.0044a243
add esp, 0x18
lea ecx, [ebp - 0x28]
call fcn.00402fe0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00402fe0
jmp 0x44a0ee
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], ebx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x44a22d
cmp dword [ebp + 0x1c], ebx
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x58]
call fcn.00402fe0
lea ecx, [ebp + 8]
call fcn.00402fe0
call fcn.0059d28a
ret

Function at 0x44a4cc
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4
Function at 0x44a707
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor eax, eax
xor ecx, ecx
xor esi, esi
push edi
cmp dword [ebp + 0xc], eax
jle 0x44a7f9
mov edi, dword [ebp + 8]
mov dl, byte [esi + edi]
movzx ebx, dl
cmp dl, 0x3d
jne 0x44a734
inc ecx
cmp ecx, 2
jg 0x44a800
cmp dl, 0x7f
ja 0x44a800
mov dl, byte [ebx + 0x5db670]
cmp dl, 0x7f
je 0x44a800
cmp dl, 0x40
jae 0x44a759
test ecx, ecx
jne 0x44a800
inc eax
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x44a71f
test eax, eax
je 0x44a7f9
mov edi, dword [ebp + 0x14]
imul eax, eax, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x44a781
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x44a802
mov edx, dword [ebp + 0x10]
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x44a7f4
mov eax, dword [ebp + 8]
push 3
pop edi
movzx eax, byte [eax]
mov cl, byte [eax + 0x5db670]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x44a7e5
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x44a7d0
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x44a7dd
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x44a7e5
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x44a795
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0xffffffffffffffee
pop eax
jmp 0x44a7fb
Function at 0x44a805
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x44a819
xor eax, eax
jmp 0x44a94f
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x44a842
dec edx
sub edx, 1
jne 0x44a844
add eax, 2
jmp 0x44a844
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x44a857
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x44a94e
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x44a8e7
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
push 3
mov al, byte [eax + 0x5db630]
mov byte [edi], al
pop eax
and ecx, eax
mov eax, edx
shr eax, 4
add ecx, ecx
and edx, 0xf
mov al, byte [eax + ecx*8 + 0x5db630]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
mov al, byte [eax + edx*4 + 0x5db630]
mov byte [edi + 2], al
mov al, byte [esi + 0x5db630]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x44a87e
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x44a8ea
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x44a941
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x44a8ff
movzx ecx, byte [eax + 1]
jmp 0x44a901
xor ecx, ecx
mov eax, edx
shr eax, 2
push 3
mov al, byte [eax + 0x5db630]
mov byte [edi], al
pop eax
and edx, eax
mov eax, ecx
add edx, edx
shr eax, 4
mov al, byte [eax + edx*8 + 0x5db630]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x44a935
and ecx, 0xf
mov al, byte [ecx*4 + 0x5db630]
jmp 0x44a937
mov al, 0x3d
mov byte [edi + 2], al
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
leave
ret