joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024d9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0x4600ba
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4025e7
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 5
lea eax, [ebp - 0x1a]
mov dword [esp], eax
call sym._fread
cmp eax, 1
je 0x40253d
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, 0
jmp 0x4025ec
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x1a]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], str.solid
jmp 0x402589
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov esi, eax
movsx eax, bl
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
cmp esi, eax
je 0x402581
sub esi, eax
mov eax, esi
jmp 0x4025ad
add dword [ebp - 0x10], 1
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test al, al
je 0x40259d
mov edx, dword [ebp - 0x14]
movzx ebx, byte [edx]
test bl, bl
jne 0x40255b
movsx edx, al
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
sub edx, eax
mov eax, edx
test eax, eax
jne 0x4025cc
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.loadModelSTL_SimpleModel__char_const__FMatrix3x3___clone_.part.62.35177.2563_
jmp 0x4025ec
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.loadModelSTL_binary_SimpleModel__char_const__FMatrix3x3_
jmp 0x4025ec
mov eax, 0
add esp, 0x30
pop ebx
pop esi
pop ebp
ret
Function at 0x402e8e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x30
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x18], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x16], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
jns 0x402f4b
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call method.ClientSocket.connectTo_std::string__int___clone_.part.1.35484.2357_
sub esp, 8
leave
ret 8

Function at 0x402fce
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x40302c
jmp 0x403032
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x403020
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call method.ClientSocket.sendAll_void_const__int___clone_.part.2.35608.2354_
jmp 0x403032
mov eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jg 0x402fe3
leave
ret 8

Function at 0x403066
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x4030c4
jmp 0x4030ca
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x4030b8
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call method.ClientSocket.recvAll_void__int___clone_.part.3.35611.2347_
jmp 0x4030ca
mov eax, dword [ebp - 0xc]
add dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jg 0x40307b
leave
ret 8
Function at 0x4048d2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
jmp 0x404903
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0xa
sete dl
cmp al, 0xd
sete al
or eax, edx
test al, al
je 0x4048fb
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp + 8]
jmp 0x40494b
add dword [ebp + 8], 1
sub dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0
je 0x404936
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fread
test eax, eax
jne 0x40493d
mov eax, 0
jmp 0x404942
mov eax, 0
jmp 0x404942
mov eax, 1
test al, al
jne 0x4048da
mov eax, 0
leave
ret
Function at 0x43b458
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x46213d
call sym._fwrite
leave
ret

Function at 0x43b488
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, eax
call method.cura::GCodeExport.resetExtrusionValue__
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x188]
cmp eax, 1
sete dl
cmp eax, 5
sete al
or eax, edx
test al, al
je 0x43b4dd
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 7
mov dword [esp + 4], 1
mov dword [esp], str.G10_S1_n
call sym._fwrite
jmp 0x43b548
mov eax, dword [ebp - 0xc]
fld qword [eax + 8]
mov eax, dword [ebp - 0xc]
fld qword [eax + 0x30]
fsubp st(1)
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x180]
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + eax + 0x160]
movsx edx, al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x174]
shl eax, 2
mov ecx, eax
shl ecx, 4
sub ecx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
fstp qword [esp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x462148
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x174]
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x170], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
test eax, eax
jle 0x43b581
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x50]
add eax, edx
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fld qword [0x462198]
fdivp st(1)
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
fstp qword [esp + 8]
mov dword [esp + 4], 0x462158
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x180], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x188]
cmp eax, 4
jne 0x43b5a5
mov eax, dword [ebp - 0xc]
mov ecx, eax
call method.cura::GCodeExport.resetExtrusionValue__
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17c], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x18c]
mov eax, dword [ebp - 0xc]
mov dword [esp], edx
mov ecx, eax
call method.cura::GCodeExport.writeCode_char_const_
sub esp, 4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x188]
cmp eax, 2
jne 0x43b5fa
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x180]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], str.M135_T_i_n
mov dword [esp], eax
call sym._fprintf
jmp 0x43b61c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x180]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], str.T_i_n
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x190]
mov eax, dword [ebp - 0xc]
mov dword [esp], edx
mov ecx, eax
call method.cura::GCodeExport.writeCode_char_const_
sub esp, 4
leave
ret 4
Function at 0x43d682
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov dword [ebp - 0x41c], ecx
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x20
cmp eax, edx
jne 0x43d6c5
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Replace:_s:_s_n
call method.cura.log_char_const__..._
jmp 0x43d7e0
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fgetpos
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memset
cmp dword [ebp - 0xc], 0
je 0x43d77f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fsetpos
leave
ret 8

Function at 0x43db50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], 0x3b
call sym._fputc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x188]
cmp eax, 3
jne 0x43dbc1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x46220e
call sym._fwrite
jmp 0x43dbd6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
leave
ret
Function at 0x43dbd8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x188]
cmp eax, 3
jne 0x43dc34
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x46220e
call sym._fwrite
jmp 0x43dc49
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
leave
ret
Function at 0x43e92e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x180]
cmp eax, dword [ebp + 8]
je 0x43e9a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x188]
cmp eax, 3
jne 0x43e992
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 0x17c]
test al, al
jne 0x43e986
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], str.M103_r_n
call sym._fwrite
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17c], 1
jmp 0x43e9a5
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call method.cura::GCodeExport.switchExtruder_int___clone_.part.7.6122_
sub esp, 4
leave
ret 4

Function at 0x43e9fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x184]
cmp eax, dword [ebp + 8]
je 0x43eb70
cmp dword [ebp + 8], 0
jle 0x43eae6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x188]
cmp eax, 2
jne 0x43ea6a
mov edx, dword [ebp + 8]
mov eax, edx
shl eax, 8
sub eax, edx
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], str.M126_T0___value___d_n
mov dword [esp], eax
call sym._fprintf
jmp 0x43eb64
cmp eax, 4
jne 0x43eaac
mov edx, dword [ebp + 8]
mov eax, edx
shl eax, 8
sub eax, edx
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], str.M106_P_d_n
mov dword [esp], eax
call sym._fprintf
jmp 0x43eb64
mov edx, dword [ebp + 8]
mov eax, edx
shl eax, 8
sub eax, edx
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], str.M106_S_d_n
mov dword [esp], eax
call sym._fprintf
jmp 0x43eb64
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x188]
cmp eax, 2
jne 0x43eb1b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], str.M127_T0_n
call sym._fwrite
jmp 0x43eb64
cmp eax, 4
jne 0x43eb3f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], str.M106_P_d_n
mov dword [esp], eax
call sym._fprintf
jmp 0x43eb64
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 5
mov dword [esp + 4], 1
mov dword [esp], str.M107_n
call sym._fwrite
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x184], edx
leave
ret 4
Function at 0x45bee0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym.___write_memory.part.0
Function at 0x45c8d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x45c908
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x45c8fe
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x45c90a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x45c8f0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x3001136d
Capabilities:
Query environment variable

Disassembly:
push 0x234
mov eax, 0x3003e6b1
call fcn.3001eda5
mov edi, ecx
lea ecx, [ebp - 0x28]
call fcn.3001094d
and dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x28]
call main
mov ecx, eax
call main
lea ecx, [ebp - 0x28]
call main
mov esi, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call main
mov eax, dword [eax + 8]
push esi
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
push eax
push dword [edi + 8]
call esi
lea ecx, [ebp - 0x28]
mov ebx, eax
call main
cmp ebx, dword [eax + 0xc]
jbe 0x300113ff
push ebx
lea ecx, [ebp - 0x28]
call main
mov ecx, eax
call main
lea ecx, [ebp - 0x28]
call main
mov ebx, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call main
mov eax, dword [eax + 8]
push ebx
push eax
push dword [edi + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x3001143c
push 0x30003694
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x240]
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30044ba4
lea eax, [ebp - 0x134]
lea edi, [ebp - 0x134]
push eax
rep movsd dword es:[edi], dword [esi]
call main
lea ecx, [ebp - 0x28]
call main
push eax
mov ecx, edi
call main
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.3000c6c3
call fcn.3001ee7d
ret
Function at 0x3001365a
Capabilities:
Enumerate files on windows

Disassembly:
push 0x4ec
mov eax, 0x3003ec89
call fcn.3001ee0e
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], eax
call main
test al, al
jne 0x300136bc
push 0x30003b3c
lea eax, [ebp - 0x4f8]
push 0x22
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30044ba4
lea eax, [ebp - 0x3ec]
lea edi, [ebp - 0x3ec]
push eax
rep movsd dword es:[edi], dword [esi]
call main
mov ecx, esi
call main
lea ecx, [ebp - 0x2b8]
call fcn.30010485
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2b8]
call main
mov esi, 0x30002cbc
push esi
lea ecx, [ebp - 0x290]
call fcn.300112b3
push 1
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 0
call fcn.300104cf
test bl, bl
je 0x30013743
push esi
lea ecx, [ebp - 0x290]
call fcn.300112b3
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0
call fcn.300104cf
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2b8]
call main
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.300102f3
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x264], eax
jne 0x300137a7
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 3
je 0x300138e3
cmp eax, 2
je 0x300138e3
push 0x30003b24
push eax
lea eax, [ebp - 0x4f8]
push eax
call main
jmp 0x3001369b
mov ebx, dword [sym.imp.kernel32.dll_lstrcmpW]
push 0x30003804
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x300138bc
push 0x30003b1c
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x300138bc
mov ecx, edi
call fcn.300102f3
push eax
lea ecx, [ebp - 0x2e0]
call fcn.300112b3
push esi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.300112b3
push 1
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 4
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 3
call fcn.300104cf
test bl, bl
je 0x30013854
push esi
lea ecx, [ebp - 0x290]
call fcn.300112b3
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.300104cf
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.300112b3
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.300104cf
lea eax, [ebp - 0x2e0]
push eax
call main
test al, al
je 0x300138ad
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x2e0]
push eax
call main
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.300104cf
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x300137a7
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.300104cf
call fcn.3001ee91
ret 0xc
Function at 0x300138fa
Capabilities:
Enumerate files on windows

Disassembly:
push 0x4ec
mov eax, 0x3003ecfe
call fcn.3001ee0e
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], eax
call main
test al, al
jne 0x3001395c
push 0x30003b3c
lea eax, [ebp - 0x4f8]
push 0x22
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30044ba4
lea eax, [ebp - 0x3ec]
lea edi, [ebp - 0x3ec]
push eax
rep movsd dword es:[edi], dword [esi]
call main
mov ecx, esi
call main
lea ecx, [ebp - 0x2b8]
call fcn.30010485
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2b8]
call main
mov esi, 0x30002cbc
push esi
lea ecx, [ebp - 0x290]
call fcn.300112b3
push 1
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 0
call fcn.300104cf
test bl, bl
je 0x300139e3
push esi
lea ecx, [ebp - 0x290]
call fcn.300112b3
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0
call fcn.300104cf
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2b8]
call main
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.300102f3
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x264], eax
jne 0x30013a47
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 3
je 0x30013b51
cmp eax, 2
je 0x30013b51
push 0x30003b50
push eax
lea eax, [ebp - 0x4f8]
push eax
call main
jmp 0x3001393b
mov ecx, edi
call fcn.300102f3
push eax
lea ecx, [ebp - 0x2e0]
call fcn.300112b3
push esi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.300112b3
push 1
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 4
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 3
call fcn.300104cf
test bl, bl
je 0x30013ac2
push esi
lea ecx, [ebp - 0x290]
call fcn.300112b3
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.300104cf
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.300112b3
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.300104cf
lea eax, [ebp - 0x2e0]
push eax
call main
test al, al
je 0x30013b1b
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x2e0]
push eax
call main
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.300104cf
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x30013a47
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.300104cf
call fcn.3001ee91
ret 0xc