joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453788
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4537e2
inc esi
xor edi, edi
cmp edi, 1
jne 0x4537ae
mov eax, dword [ebp + 0xc]
push eax
call fcn.00405aec
jmp 0x4537bc
cmp edi, 1
jle 0x4537bc
mov eax, dword [ebp + 8]
push eax
call fcn.00405aec
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00450d4c
test eax, eax
jne 0x4537e2
call fcn.00405934
cmp eax, 2
je 0x4537e2
call fcn.00405934
cmp eax, 3
je 0x4537e2
inc edi
dec esi
jne 0x45379e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x453eb0
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042da0c
and eax, 0x7f
mov ecx, dword [eax*4 + 0x48ea30]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dc1c
test eax, eax
jne 0x453efa
mov eax, esi
call fcn.00403750
push eax
mov eax, dword [esp + 4]
push eax
call fcn.004057c4
mov eax, dword [esp]
push eax
call fcn.004057ac
mov eax, ebx
call fcn.00403750
push eax
call fcn.00405cf4
test eax, eax
je 0x453f1b
push 0
push 0
push 0x1d
push 0xffff
call fcn.0040614c
pop edx
pop esi
pop ebx
ret

Function at 0x453f20
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x454054
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x454068
push 0x45407c
call fcn.0040595c
push eax
call fcn.00405974
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00450b68
test al, al
jne 0x453f75
mov byte [ebp - 2], 0
jmp 0x454039
xor eax, eax
push ebp
push 0x454032
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x453fae
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c3e0
mov eax, dword [ebp - 0x20]
call fcn.00403750
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x45401c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c738
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042c800
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c3e0
mov eax, dword [ebp - 0x20]
call fcn.00403750
push eax
call fcn.004058fc
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x45401c
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00430270
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00430270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454039
lea eax, [ebp - 0xc]
call fcn.00450ba4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45405b
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403438
ret
Function at 0x454308
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4544fe
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x45434b
lea eax, [ebp - 8]
push eax
push 0x48e774
push 1
push 0
push 0x48ea38
call fcn.0042cb64
jmp 0x454350
mov eax, 0x80004005
test eax, eax
je 0x45437d
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x48e774
push 1
push 0
push 0x48e764
call fcn.0042cb64
test eax, eax
je 0x45437d
mov edx, eax
mov eax, 0x454518
call fcn.0045187c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4544e1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
mov eax, dword [ebp + 0x24]
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebp + 0x20], 0
je 0x4543d1
mov eax, dword [ebp + 0x20]
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
cmp dword [ebp + 0x1c], 0
je 0x4543ed
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
test edi, edi
je 0x45440f
mov eax, edi
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
cmp word [ebp + 0x10], 0
je 0x454424
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
lea eax, [ebp - 0xc]
push eax
push 0x48e744
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, eax
je 0x454445
mov edx, eax
mov eax, 0x454534
call fcn.0045187c
test bl, bl
je 0x45446b
call fcn.00454210
test al, al
je 0x45446b
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, esi
call fcn.0042c484
mov eax, dword [ebp - 0x14]
call fcn.00403cbc
mov dword [ebp - 0x10], eax
jmp 0x454475
mov eax, esi
call fcn.00403cbc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x454480
call fcn.00408b98
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
test eax, eax
je 0x45449f
mov edx, eax
mov eax, 0x454558
call fcn.0045187c
mov ecx, dword [ebp + 8]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00454220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4544e8
cmp dword [ebp - 0x10], 0
je 0x4544c8
mov eax, dword [ebp - 0x10]
push eax
call fcn.0042cb7c
cmp dword [ebp - 0xc], 0
je 0x4544d7
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
Function at 0x4564c8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x4565a2
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4565b0
call fcn.00455538
mov eax, dword [esi + 0xc]
push eax
call fcn.004057fc
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x456520
mov eax, 0x4565e4
call fcn.00455348
push 1
mov eax, dword [esi + 8]
push eax
call fcn.00405af4
push 0x2710
mov eax, dword [esi + 8]
push eax
call fcn.00405b24
cmp eax, 0x102
je 0x45650b
push esp
mov eax, dword [esi + 8]
push eax
call fcn.00405914
test eax, eax
je 0x456573
cmp dword [esp], 0
jne 0x456555
mov eax, 0x456614
call fcn.00455348
jmp 0x45657d
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x456634
call fcn.00455538
jmp 0x45657d
mov eax, 0x45666c
call fcn.00455348
mov eax, dword [esi + 8]
push eax
call fcn.004057fc
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x4565a2
push 0xfa
call fcn.00405aec
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x4566a0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4568e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x45687f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call fcn.00405824
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x456715
mov eax, 0x4568fc
call fcn.00451868
xor edx, edx
push ebp
push 0x456814
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x2034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00405b04
test eax, eax
jne 0x4567fd
call fcn.00405934
cmp eax, 0x3e5
je 0x45677d
mov eax, 0x456910
call fcn.00451868
xor edx, edx
push ebp
push 0x4567e6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4567bb
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x4567bb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.004060ac
dec eax
je 0x45679b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4567ed
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call fcn.00405964
mov ebx, eax
call fcn.00405934
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45681b
mov eax, dword [ebp - 0xc]
push eax
call fcn.004057fc
ret

Function at 0x4572f8
Capabilities:
Read .ini file

Disassembly:
add esp, 0xffffff00
mov byte [esp], 0
cmp byte [edx], 0
je 0x457321
push edx
push pe_nt_image_headers32
lea edx, [esp + 8]
push edx
push 0x457348
push 0
push eax
call fcn.0040596c
jmp 0x457338
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push 0x457348
push 0
push eax
call fcn.0040597c
cmp byte [esp], 0
sete al
add esp, 0x100
ret
Function at 0x459acc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [0x48e0dc], 2
jne 0x459af5
call fcn.004059bc
and ax, 0xff
cmp ax, 5
jae 0x459b01
mov dword [ebp - 0xc], 1
jmp 0x459d09
push 0x459d18
call fcn.0040595c
mov esi, eax
push 0x459d28
push esi
call fcn.00405974
mov edi, eax
push 0x459d40
push esi
call fcn.00405974
mov dword [ebp - 0x10], eax
push 0x459d58
push esi
call fcn.00405974
mov dword [ebp - 0x14], eax
test edi, edi
je 0x459b46
cmp dword [ebp - 0x10], 0
je 0x459b46
cmp dword [ebp - 0x14], 0
jne 0x459b52
mov dword [ebp - 0xc], 0x7f
jmp 0x459d09
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403750
push eax
call edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x459d09
xor edx, edx
push ebp
push 0x459d02
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0xc]
shl eax, 5
call fcn.0040693c
mov dword [ebp - 0x24], eax
mov esi, ebx
mov edi, dword [ebp + 0xc]
dec edi
test edi, edi
jl 0x459c3f
inc edi
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov al, byte [esi + 6]
push eax
push esi
call fcn.0040576c
test eax, eax
jne 0x459bf5
call fcn.00405934
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x459beb
mov dword [ebp - 0xc], 0x57
call fcn.004031d4
jmp 0x459d09
mov eax, ebx
shl eax, 2
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x10]
mov dword [edx + eax*8], ecx
mov edx, dword [ebp - 0x24]
mov dword [edx + eax*8 + 4], 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x18], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 0x1c], ecx
add esi, 0x14
inc ebx
dec edi
jne 0x459bb0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459c65
call fcn.004031d4
jmp 0x459d09
xor eax, eax
push ebp
push 0x459ca9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403750
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459cb0
mov eax, dword [ebp - 0x20]
push eax
call fcn.00405a3c
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d1b4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d288
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c3e0
lea eax, [ebp - 0x14c]
mov edx, 0x45d2a4
call fcn.00403594
mov eax, dword [ebp - 0x14c]
call fcn.00403750
push eax
call fcn.0040587c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45d26f
xor eax, eax
push ebp
push 0x45d268
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.0045d168
test al, al
je 0x45d23d
mov byte [ebp - 1], 1
jmp 0x45d251
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00405884
test eax, eax
jne 0x45d228
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d26f
mov eax, dword [ebp - 8]
push eax
call fcn.00405874
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d28f
lea eax, [ebp - 0x14c]
call fcn.00403418
ret

Function at 0x45d2a8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403750
push eax
call fcn.0042cbb4
test eax, eax
je 0x45d2e8
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00403574
jmp 0x45d2ef
mov eax, ebx
call fcn.00403418
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x45d2f8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x48eaa4]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403750
push eax
call fcn.0042cbb4
test eax, eax
je 0x45d338
mov eax, dword [esp + 4]
jmp 0x45d33a
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x45d344
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x48eaac]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x45d388
call fcn.0042cbb4
test eax, eax
je 0x45d37e
mov eax, dword [esp + 4]
jmp 0x45d380
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x45d368
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x48eaac]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x45d388
call fcn.0042cbb4
test eax, eax
je 0x45d37e
mov eax, dword [esp + 4]
jmp 0x45d380
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x45d73c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x45d750
add esp, 0xfffffff0
call fcn.00402d48
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00415930
mov ax, word [0x45d7f0]
not eax
and ax, word [esi + 0x34]
mov word [esi + 0x34], ax
mov edx, 0x79
mov eax, esi
call fcn.00414600
mov edx, 0x61
mov eax, esi
call fcn.00414620
xor edx, edx
mov eax, esi
call fcn.00414c34
mov dl, 1
mov eax, esi
call fcn.004182fc
call fcn.004059bc
and ax, 0xff
cmp ax, 6
jae 0x45d7b1
mov dx, 0xfffe
mov eax, esi
call fcn.00414c54
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call fcn.004061fc
test eax, eax
je 0x45d7d7
lea eax, [ebp - 0x3c]
push eax
call fcn.00405bd4
mov edx, eax
mov eax, dword [esi + 0x44]
call fcn.0041a2bc
test bl, bl
je 0x45d7e5
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45e650
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45e71a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040594c
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x45e68b
mov eax, ebx
call fcn.0045d398
test al, al
je 0x45e6f3
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403528
lea eax, [ebp - 8]
mov edx, 0x45e730
call fcn.00403594
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0045d2a8
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00402878
mov edx, 0x45e734
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00402848
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00403538
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0045e1c0
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x45e678
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e721
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403438
ret
Function at 0x45e738
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45e8f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call fcn.00405ab4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45e8c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040358c
cmp eax, 3
jne 0x45e7c4
mov eax, ebx
call fcn.0045d598
test al, al
jne 0x45e7a4
mov byte [ebp - 1], 0
call fcn.004031d4
jmp 0x45e8cf
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0045d2a8
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0045eb30
mov byte [ebp - 1], 1
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c3e0
lea eax, [ebp - 0x154]
mov edx, 0x45e910
call fcn.00403594
mov eax, dword [ebp - 0x154]
call fcn.00403750
push eax
call fcn.0040587c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45e8b1
xor eax, eax
push ebp
push 0x45e8aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.0045d168
test al, al
je 0x45e87f
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403574
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c3e0
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
call fcn.00403594
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.0045d2a8
mov eax, dword [ebp - 0x154]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045e1c0
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405884
test eax, eax
jne 0x45e818
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e8b1
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405874
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e8cf
mov eax, dword [ebp - 8]
push eax
call fcn.00405ab4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e8fc
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.00403438
lea eax, [ebp - 0x10]
call fcn.00403418
ret
Function at 0x45ebb4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45ed9b
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x45ec27
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0042c888
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c3e0
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0042c584
test eax, eax
jne 0x45ec27
lea edx, [ebp - 4]
mov eax, edi
call fcn.0042c860
push 1
call fcn.00405ab4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45ed66
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c3e0
lea eax, [ebp - 0x154]
mov edx, 0x45edb4
call fcn.00403594
mov eax, dword [ebp - 0x154]
call fcn.00403750
push eax
call fcn.0040587c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45ed4f
xor eax, eax
push ebp
push 0x45ed48
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.0045d168
test al, al
je 0x45ed19
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403574
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042c584
test eax, eax
je 0x45ed19
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045e2a8
test eax, eax
jne 0x45ed19
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0042c3e0
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
call fcn.00403594
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.0045d2a8
mov eax, dword [ebp - 0x154]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045e1c0
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405884
test eax, eax
jne 0x45ec8f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ed4f
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405874
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ed6d
mov eax, dword [ebp - 8]
push eax
call fcn.00405ab4
ret
Function at 0x461adc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461c61
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2dc]
mov edx, 0x20
call fcn.00414600
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2dc]
mov edx, 0x20
call fcn.00414620
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.00414600
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.00414620
xor eax, eax
push ebp
push 0x461c41
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x461c70
call fcn.0042cbb4
test eax, eax
je 0x461bb5
cmp byte [ebp - 0x158], 0
je 0x461bb5
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x48f014]
push eax
call fcn.0042cbac
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2dc]
call fcn.00461a1c
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.00474714
cmp dword [ebp - 4], 0
jne 0x461bd9
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.00474714
cmp dword [ebp - 4], 0
je 0x461c37
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.0042cbb4
test eax, eax
je 0x461c37
cmp byte [ebp - 0x158], 0
je 0x461c37
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x48f014]
push eax
call fcn.0042cbac
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e0]
call fcn.00461a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x461c4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c68
lea eax, [ebp - 4]
call fcn.00403418
ret