joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437118
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esp + 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x43717a
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 8
ret

Function at 0x4375b0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ecx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp ebp, esi
jne 0x4375ce
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
test esi, esi
jne 0x4375e0
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4375f4
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4376e7
push ebx
push edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebp
mov ebx, eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 1
push edi
push ebx
call esi
push 1
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4376c1
push eax
push eax
push eax
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x4376c9
mov dword [esp + 0x10], 4
jmp 0x4376c9
mov dword [esp + 0x10], 3
push 0
push ebp
push ebx
call esi
push 0
push edi
push ebx
call esi
push 0
push ebp
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 4
pop esi
mov eax, 2
pop ebp
pop ecx
ret 4
Function at 0x4422b9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x224
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
mov esi, dword [esp + 0x234]
push edi
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call ebp
cmp eax, 0x103
je 0x4423cd
mov edi, dword [esp + 0x23c]
mov eax, edi
or eax, 0x20019
mov dword [esp + 0x18], eax
jmp 0x44231d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
lea edx, [esp + 0x3c]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4423e4
mov eax, dword [esp + 0x14]
push edi
push eax
call fcn.004422b9
mov ecx, dword [esp + 0x1c]
add esp, 8
push ecx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4423e4
lea edx, [esp + 0x1c]
xor ebx, ebx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call fcn.00434153
test al, al
je 0x44238a
push ebx
push edi
lea eax, [esp + 0x38]
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
call fcn.0044229a
call eax
jmp 0x442396
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
jne 0x4423da
lea eax, [esp + 0x1c]
push eax
call fcn.004344a0
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
push esi
mov dword [esp + 0x30], 0xff
call ebp
cmp eax, 0x103
jne 0x442319
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret
lea ecx, [esp + 0x1c]
push ecx
call fcn.004344a0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x224
ret
Function at 0x443390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a7cb8], 0
push esi
push edi
mov esi, 0x4a72e8
jne 0x4433b0
push 0
call fcn.00414cef
push eax
call fcn.004353b4
add esp, 8
mov dword [0x49223c], 0x270
mov dword [0x4a72e4], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x4433c5
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x443400
mov ecx, dword [0x4a72e8]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x443887
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x44396c
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4438d9
push 1
push esi
push eax
call fcn.0043569d
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0xc
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x443947
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x44391c
cmp eax, 0xffffffff
jne 0x4438c4
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 1
push accept
push 0x487658
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4438d9
test eax, eax
je 0x4438d9
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.0043569d
push esi
call fcn.004356cd
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0xc
test al, 1
je 0x443909
mov eax, dword [esi]
test eax, eax
je 0x4438e8
pop esi
add esp, 0xc
ret 0xc
Function at 0x443981
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x443a68
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4439d6
push 1
push esi
push eax
call fcn.0043569d
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0x14
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 8]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x443a43
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x443a18
cmp eax, 0xffffffff
jne 0x4439c1
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 2
push 0x40000000
push 0x487658
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4439d6
test eax, eax
je 0x4439d6
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.0043569d
push esi
call fcn.004356cd
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0x14
test dword [esp + 0x18], eax
je 0x443a06
mov eax, dword [esi]
test eax, eax
je 0x4439e5
pop esi
add esp, 0xc
ret 0x14

Function at 0x443aa6
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
push ecx
mov dword [esp + 0x18], edx
call fcn.004356e7
test al, al
je 0x443af8
test ebx, ebx
je 0x443af8
test edi, edi
je 0x443af8
push esi
push edx
lea eax, [esp + 0x1c]
push eax
lea esi, [ecx + 0x18]
mov ecx, dword [esi]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x443aee
push esi
call fcn.004356cd
add esp, 4
mov eax, dword [esp + 0x18]
pop esi
pop edi
pop ebx
ret 0xc
pop edi
mov eax, edx
pop ebx
ret 0xc

Function at 0x443eef
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x443f0c
push esi
call fcn.00436486
add esp, 4
test al, al
jne 0x443f25
push 1
jmp 0x443f0e
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret
Function at 0x44419b
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
mov byte [0x497296], 0
test edi, edi
je 0x4441e2
mov byte [0x497297], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x444078
push esi
push esi
mov dword [esp + 0x24], edi
call fcn.0041415e
add esp, 0x18
mov esi, eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
test esi, esi
je 0x444219
push 0xffffffffffffffff
push esi
mov byte [0x497297], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x497296], 1
jne 0x44422b
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x444343
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00444326
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
ret 0xc
Function at 0x447870
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 0x4a83d8
call fcn.004340b2
mov ecx, dword [0x4a8438]
mov edx, dword [ecx + eax*4]
mov edi, dword [edx]
cmp ebx, esi
jne 0x4478f7
cmp dword [edi + 0x194], 0
je 0x4478d3
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x194]
push 0
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x24]
shl edx, 0x10
or edx, eax
push edx
push ebx
push 0x7b
push esi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
push ebx
push 0x4a83d8
call fcn.004421c1
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4478d3
mov ecx, dword [0x4a844c]
mov edx, dword [ecx + ebp*4]
mov ecx, dword [edx]
mov al, byte [ecx + 0x88]
cmp al, 0xe
je 0x4478d3
cmp al, 0xf
je 0x4478d3
cmp al, 0x13
je 0x4478d3
cmp al, 0x10
je 0x4478d3
cmp dword [ecx + 8], 0
je 0x4478d3
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
mov ecx, dword [0x4a844c]
push edx
mov edx, dword [ecx + ebp*4]
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x4498fd
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
push ebp
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x4a83d8
xor ebp, ebp
call fcn.0044213b
test al, al
jne 0x449929
pop esi
xor eax, eax
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4a8438]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov ecx, dword [0x4a844c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edx*4]
push ebx
mov ebx, dword [eax]
push edi
mov edi, dword [ebx]
cmp esi, 0xffffffff
je 0x4499cf
movzx eax, byte [ebx + 0x88]
add eax, 0xfffffffe
cmp eax, 0x14
ja case.0x44996a.4
movzx ecx, byte [eax + 0x449a91]
jmp dword [ecx*4 + 0x449a75]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 0xc
or esi, 0xe
jmp case.0x44996a.4
or esi, 3
jmp case.0x44996a.4
or esi, 4
push 0
test esi, 0x800
je 0x4499a1
push 1
push 0xcf
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x44996a.4
push 0
push 0xcf
push edi
or esi, 0x10000
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x44996a.4
or esi, 0x4000000
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ebp, eax
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x449a0d
push esi
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [0x4a844c]
mov ebp, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
cmp byte [edx + 0x88], 0x13
jne 0x449a0d
push esi
push 0
push 0x1036
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
mov al, byte [ebx + 0x8b]
cmp al, 0xff
je 0x449a31
mov ecx, dword [esp + 0x14]
movzx eax, al
cmp eax, dword [ecx + 0x184]
je 0x449a31
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449a3e
mov edx, dword [esp + 0x14]
push 1
push ebx
push edx
call fcn.0043401c
mov al, byte [ebx + 0x88]
cmp al, 2
je 0x449a51
cmp al, 3
je 0x449a51
cmp esi, 0xffffffff
je 0x449a66
mov eax, dword [ebx]
push 0x27
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
xor eax, eax
test ebp, ebp
pop esi
setne al
pop ebp
ret 0xc
Function at 0x44b2e9
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49223c], 1
jne 0x44b2f8
call fcn.00443390
mov ecx, dword [0x4a72e4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a72e4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44b341
fadd qword [0x48c528]
fmul qword [0x48c530]
pop ecx
ret

Function at 0x44b7a4
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44b7b6
push eax
call fcn.0044b64f
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x44b7c7
mov dword [esp + 4], eax
jmp fcn.0044b64f
ret 4

Function at 0x44b7ca
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x44b7f4
push esi
call fcn.0043572f
test al, al
je 0x44b7f4
mov eax, dword [esi + 8]
push eax
call fcn.004437fa
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0044b6bc
cmp dword [esi + 0x24], 0
jne 0x44b827
push esi
call fcn.00435713
test al, al
je 0x44b827
push esi
call fcn.00435703
test al, al
jne 0x44b827
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004437fa
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0044b6bc
pop esi
ret 4

Function at 0x44bb20
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040ffb0
lea eax, [esp + 0x20]
push eax
call fcn.00436ac4
add esp, 4
test al, al
jne 0x44bb4b
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44bb6f
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret
Function at 0x452126
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x27c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x290]
lea esi, [esp + 0x10]
mov dword [esp + 0x20], ecx
call fcn.00401b70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
inc dword [eax]
mov dword [esp + 0x34], eax
mov edi, 0x48a088
mov eax, esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call fcn.0040d330
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
push eax
push ecx
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x4522be
mov ebp, dword [esp + 0x29c]
mov edx, dword [esp + 0x20]
push edx
call fcn.00443009
cmp eax, 1
je 0x4522bc
cmp eax, 0xb
jne 0x4521ba
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x452198
lea eax, [esp + 0x64]
push 0x48724c
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x4522a2
lea ecx, [esp + 0x64]
push 0x48a090
push ecx
call fcn.004133e4
add esp, 8
test eax, eax
je 0x4522a2
lea edx, [esp + 0x28]
push edx
lea esi, [esp + 0x14]
call fcn.0040df50
lea edi, [esp + 0x64]
mov eax, esi
call fcn.0040d330
test byte [esp + 0x38], 0x10
je 0x45226f
cmp byte [esp + 0x2a0], 0
je 0x452220
add dword [ebp], 1
adc dword [ebp + 4], 0
cmp byte [esp + 0x2a4], 0
je 0x4522a2
mov edi, 0x484e10
lea eax, [esp + 0x10]
call fcn.0040d330
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
mov edx, dword [esp + 0x298]
push eax
mov eax, dword [esp + 0x298]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push edx
push eax
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00452126
mov bl, al
test bl, bl
je 0x4522be
jmp 0x4522a2
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
xor edx, edx
xor esi, esi
or edx, eax
mov eax, dword [esp + 0x294]
or ecx, esi
add dword [eax], edx
adc dword [eax + 4], ecx
cmp byte [esp + 0x2a0], 0
je 0x4522a2
mov eax, dword [esp + 0x298]
add dword [eax], 1
adc dword [eax + 4], esi
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452198
jmp 0x4522be
xor bl, bl
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x28]
call fcn.00402620
lea ecx, [esp + 0x10]
call fcn.00402620
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x27c
ret 0x18
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0xe18e3186
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0x164d5643
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0x11b37bb7
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0xa58c142c
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0xd0172293
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc