joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442c78
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x442c8f
add esp, 0xfffffff0
call fcn.00403124
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041305c
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40d0e4]
call fcn.00402df4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40d0e4]
call fcn.00402df4
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x414eb4]
call fcn.0041c044
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x442e04
mov eax, dword [0x45f688]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041c414
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x444720
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45f688]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ac68
test eax, eax
je 0x442d82
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408c70
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ac90
test eax, eax
je 0x442d96
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403cdc
mov eax, dword [0x45f580]
cmp byte [eax], 0
jne 0x442dc7
mov eax, ebx
call fcn.00442ef0
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x442df9
call fcn.0040317c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443160
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4607c8]
cmp dword [eax + 0x24], 0
je 0x443203
cmp dword [ebx + 0x84], 0
jne 0x4431fd
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4430f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x4431fd
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4431c6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4431fd
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040e7a8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4431d5
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x443c10
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x443c45
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b94
jmp 0x443c4f
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403b00
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x444a94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x444acc
mov eax, esi
call fcn.0042c368
test al, al
je 0x444acc
mov eax, dword [ebx + 0x74]
call fcn.0042c06c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x444acc
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042c06c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x448c98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403ef0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x448cb1
test al, 0x10
jne 0x448cb5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x449fdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
test dl, dl
je 0x44a052
mov al, byte [ebx + 0x48]
add al, 0xf9
sub al, 2
jb 0x44a01c
sub al, 2
jb 0x449fff
sub al, 3
je 0x449fff
add al, 0xf4
sub al, 2
jae 0x44a052
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jle 0x44a052
call fcn.0044eacc
xor byte [esi], al
mov al, byte [esi]
call fcn.0044eaec
inc esi
dec edi
jne 0x44a008
jmp 0x44a052
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jle 0x44a052
movzx eax, word [ebx + 0x4a]
mov edx, dword [ebx + 0x38]
mov al, byte [edx + eax - 1]
xor byte [esi], al
mov eax, dword [ebx + 0x38]
call fcn.00403d2c
movzx edx, word [ebx + 0x4a]
cmp eax, edx
jne 0x44a04a
mov word [ebx + 0x4a], 1
jmp 0x44a04e
inc word [ebx + 0x4a]
inc esi
dec edi
jne 0x44a025
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x44eaec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x4608ac
mov edx, dword [esi]
mov eax, ebx
call fcn.0044fb20
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00406e38
call fcn.00406e3c
mov edx, dword [esi + 8]
call fcn.0044fb20
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x44eca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00403ee0
xor eax, eax
push ebp
push 0x44ed71
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp + 8], 0
je 0x44ed5b
mov eax, dword [ebp + 8]
call fcn.0044eb34
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x44ed1e
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.0044eacc
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.0044eaec
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x44ecf0
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x44ed48
mov eax, dword [ebp + 0x10]
call fcn.00406e38
call fcn.00406e3c
cmp bl, al
jne 0x44ed5b
mov byte [ebp - 2], 1
jmp 0x44ed5b
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x44ed5b
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ed78
lea eax, [ebp + 8]
call fcn.00403aac
ret

Function at 0x44f528
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00403ef0
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
test esi, esi
je 0x44f551
cmp ebx, 0xffffffff
je 0x44f54c
and ebx, 0x10
cmp ebx, 0x10
je 0x44f551
xor eax, eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x44ffc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x44ffea
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
movzx ebx, word [ebx*2 + 0x45f07c]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x44ffc6
pop esi
pop ebx
ret

Function at 0x450334
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ee0
xor eax, eax
push ebp
push 0x450406
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4503e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d2c
test eax, eax
jle 0x4503c6
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x450420
mov edx, dword [ebp - 4]
call fcn.00403d78
mov eax, dword [ebp - 0x10]
call fcn.00403ef0
push eax
call sub.kernel32.dll_GetVolumeInformationA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
jmp 0x4503ca
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4503e8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4506a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403ee0
xor eax, eax
push ebp
push 0x450780
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x78], 4
jne 0x4506d9
mov byte [ebp - 5], 1
jmp 0x450762
mov eax, ebx
xor ecx, ecx
mov edx, 0x18
call fcn.00402b24
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45075b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0044f2a0
mov eax, dword [ebp - 0x10]
call fcn.00403ef0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov eax, dword [ebx + 4]
imul dword [ebx]
imul dword [ebx + 8]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 4]
imul dword [ebx]
imul dword [ebx + 0xc]
mov dword [ebx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450762
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450787
lea eax, [ebp - 0x10]
call fcn.00403aac
lea eax, [ebp - 4]
call fcn.00403aac
ret

Function at 0x45088c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403ee0
xor eax, eax
push ebp
push 0x4508f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d2c
test eax, eax
jle 0x4508da
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0044f2a0
mov eax, dword [ebp - 8]
call fcn.00403ef0
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x4508dc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4508fe
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ad0
ret

Function at 0x4522d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xf0]
mov edx, dword [ebp + 0xc]
call fcn.00408ccc
push eax
lea eax, [ebp - 0xa0]
mov edx, edi
call fcn.00408ccc
push eax
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.00408ccc
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45c094
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ee0
xor eax, eax
push ebp
push 0x45c225
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x45c1fa
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.0045c038
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 4]
call fcn.00403b44
lea eax, [ebp - 0x148]
xor ecx, ecx
mov edx, 0x140
call fcn.00402b24
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x45c23c
mov edx, dword [ebp - 4]
call fcn.00403d78
mov eax, dword [ebp - 0x150]
call fcn.00403ef0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
mov eax, esi
cdq
cmp edx, 0
jne 0x45c147
cmp eax, 0xffffffff
je 0x45c1f4
lea edx, [ebp - 8]
lea eax, [ebp - 0x11c]
call fcn.00408e3c
test bl, bl
je 0x45c1b3
mov eax, dword [ebp - 0x148]
and eax, 0x10
cmp eax, 0x10
jne 0x45c1b3
mov eax, dword [ebp - 8]
mov edx, 0x45c24c
call fcn.00403e3c
je 0x45c1df
mov eax, dword [ebp - 8]
mov edx, 0x45c258
call fcn.00403e3c
je 0x45c1df
push dword [ebp - 4]
push 0x45c264
push dword [ebp - 8]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403dec
mov eax, dword [ebp - 0x154]
call fcn.0045c07c
jmp 0x45c1df
push dword [ebp - 4]
push 0x45c264
push dword [ebp - 8]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403dec
mov eax, dword [ebp - 0x158]
call fcn.00403ef0
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45c14d
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c22c
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.00403ad0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ad0
ret
Function at 0x45c3d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x45c5a1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b24
mov dword [ebp - 0x5c], 0x44
test bl, bl
je 0x45c415
mov word [ebp - 0x2c], 6
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402b24
lea eax, [ebp - 0x10]
call fcn.00403aac
test edi, edi
jne 0x45c437
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x45c44b
mov eax, edi
call fcn.00403ef0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.0040885c
test esi, esi
jne 0x45c456
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x45c4ca
mov eax, esi
call fcn.00403ef0
mov dword [ebp - 0x18], eax
mov ebx, 1
mov eax, esi
call fcn.00403d2c
jmp 0x45c46f
inc ebx
cmp eax, ebx
jl 0x45c47a
cmp byte [esi + ebx - 1], 0x20
je 0x45c46e
cmp eax, ebx
jle 0x45c4ca
cmp byte [esi + ebx - 1], 0x22
jne 0x45c49b
lea edx, [ebx + 1]
mov dword [ebp - 8], edx
jmp 0x45c48e
inc ebx
cmp eax, ebx
jl 0x45c4ac
cmp byte [esi + ebx - 1], 0x22
jne 0x45c48d
jmp 0x45c4ac
mov dword [ebp - 8], ebx
jmp 0x45c4a1
inc ebx
cmp eax, ebx
jl 0x45c4ac
cmp byte [esi + ebx - 1], 0x20
jne 0x45c4a0
lea eax, [ebp - 0x70]
push eax
mov ecx, ebx
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00403f34
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x10]
call fcn.0040885c
cmp dword [ebp - 0x10], 0
jne 0x45c4d4
xor ebx, ebx
jmp 0x45c4de
mov eax, dword [ebp - 0x10]
call fcn.00403ef0
mov ebx, eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CreateProcessA
mov edx, 0x45c5bc
call fcn.0045c2f4
xor eax, eax
push ebp
push 0x45c57c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x6c]
call fcn.0045c268
test al, al
jne 0x45c545
mov eax, 0x45c5d0
call fcn.0045c684
jmp 0x45c545
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x45c55f
cmp dword [ebp - 0xc], 0x103
je 0x45c53e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c583
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x45c7ac
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c99e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x45c7f1
mov eax, ebx
call fcn.00448c98
test al, al
jne 0x45c87a
mov eax, 0x200
call fcn.004026d8
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45c873
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x200
mov eax, dword [ebp - 0x14]
call fcn.00406e4c
mov eax, dword [ebp - 0x14]
push eax
push 0x1ff
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
cmp ebx, 0x1ff
jbe 0x45c852
lea esi, [ebx + 1]
mov edx, esi
lea eax, [ebp - 0x14]
call fcn.00402708
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.00406e4c
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00408e3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c884
mov eax, dword [ebp - 0x14]
call fcn.004026f0
ret
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403b44
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x22]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
movzx eax, word [ebp - 0x1e]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x18]
movzx edx, word [ebp - 0x16]
imul edx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
lea edx, [ebp - 0x54]
mov ecx, 4
mov eax, 0x45c9b4
call fcn.00409384
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 4]
call fcn.00403d78
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0045c75c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00403b00
jmp 0x45c934
push dword [ebp - 0xc]
push 0x45c9d8
lea edx, [ebp - 0x58]
mov eax, dword [0x45f560]
call fcn.0040831c
push dword [ebp - 0x58]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00403dec
inc dword [0x45f560]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [ebp - 0x5c]
mov ecx, 0x45c9e4
call fcn.00403d78
mov eax, dword [ebp - 0x5c]
call fcn.00403ef0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x45c909
mov eax, dword [ebp - 8]
mov edx, 0x45c9e4
call fcn.00403d34
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c9a5
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00403ad0
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403ad0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403ad0
ret
Function at 0x45cc8c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ee0
lea edi, [ebp - 0x14c]
xor eax, eax
push ebp
push 0x45ce57
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.0045cc4c
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
call fcn.00403b44
mov eax, edi
xor ecx, ecx
mov edx, 0x140
call fcn.00402b24
push edi
lea eax, [ebp - 0x154]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.00403d78
mov eax, dword [ebp - 0x154]
call fcn.00403ef0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
mov eax, ebx
cdq
cmp edx, 0
jne 0x45cd38
cmp eax, 0xffffffff
je 0x45cd78
lea edx, [ebp - 0xc]
lea eax, [edi + 0x2c]
call fcn.00408e3c
test byte [edi], 0x10
jne 0x45cd67
lea eax, [ebp - 0x158]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403d78
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
push edi
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45cd3a
push ebx
call sub.kernel32.dll_FindClose_1
cmp byte [ebp - 5], 0
je 0x45ce29
mov eax, edi
xor ecx, ecx
mov edx, 0x140
call fcn.00402b24
push edi
lea eax, [ebp - 0x15c]
mov ecx, 0x45ce70
mov edx, dword [ebp - 4]
call fcn.00403d78
mov eax, dword [ebp - 0x15c]
call fcn.00403ef0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
mov eax, ebx
cdq
cmp edx, 0
jne 0x45cdc2
cmp eax, 0xffffffff
je 0x45ce29
lea edx, [ebp - 0xc]
lea eax, [edi + 0x2c]
call fcn.00408e3c
test byte [edi], 0x10
je 0x45ce18
mov eax, dword [ebp - 0xc]
mov edx, 0x45ce7c
call fcn.00403e3c
je 0x45ce18
mov eax, dword [ebp - 0xc]
mov edx, 0x45ce88
call fcn.00403e3c
je 0x45ce18
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403d78
mov eax, dword [ebp - 0x160]
mov ecx, esi
mov dl, 1
call fcn.0045cc8c
push edi
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45cdc4
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ce5e
lea eax, [ebp - 0x160]
mov edx, 5
call fcn.00403ad0
lea eax, [ebp - 0xc]
call fcn.00403aac
lea eax, [ebp - 4]
call fcn.00403aac
ret
Function at 0x45d2d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x45d2dc
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45d5a1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x45f7cc]
mov eax, dword [eax]
call fcn.004444ac
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.0040885c
lea eax, [ebp - 4]
call fcn.0045cc18
mov dl, 1
mov eax, dword [0x40d3e4]
call fcn.00402df4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45d3bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x45d5b8
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0045cf54
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x45d3a7
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, 0x45d5c4
call fcn.00404018
test eax, eax
jle 0x45d3a3
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403d78
mov eax, dword [ebp - 0x1c]
call fcn.00403ef0
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x45d3a7
inc ebx
dec esi
jne 0x45d35a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d3c4
mov eax, dword [ebp - 0x10]
call fcn.00402e24
ret