joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424830
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x51ebe7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
mov esi, dword [esp + 0x24]
push esi
call fcn.00422890
add esp, 4
test eax, eax
je 0x424880
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.00507da8
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
call fcn.00507da8
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.00507da8
push 0x5c
push 0x2f
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call fcn.00504d6b
push 0x5c
lea ecx, [esp + 0x28]
call fcn.0050558b
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.00504d6b
push 0x5c
lea ecx, [esp + 8]
call fcn.0050558b
push 0x5c
lea ecx, [esp + 8]
call fcn.00505681
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x424910
push 0x10e
lea ecx, [esp + 0x28]
call fcn.0050816a
push eax
push 0x10e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call fcn.005081b9
mov edx, dword [esp + 4]
mov eax, dword [edx - 8]
test eax, eax
je 0x424934
push 0x5c
lea ecx, [esp + 0x28]
call fcn.0050813d
lea eax, [esp + 4]
lea ecx, [esp + 0x24]
push eax
call fcn.00508152
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.00507aaf
lea ecx, [esp + 4]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 1
call fcn.00507d3a
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 0
call fcn.00507d3a
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x424980
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
call fcn.0050c68e
mov eax, dword [0x569c90]
lea ecx, [esp + 4]
mov dword [esi + 0x30], eax
push ecx
mov dword [esi], method.CFile.virtual_0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x10], 0xffffffff
mov eax, esi
pop esi
add esp, 0x24
ret

Function at 0x424983
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
call fcn.0050c68e
mov eax, dword [0x569c90]
lea ecx, [esp + 4]
mov dword [esi + 0x30], eax
push ecx
mov dword [esi], method.CFile.virtual_0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x10], 0xffffffff
mov eax, esi
pop esi
add esp, 0x24
ret
Function at 0x424c60
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51ec88
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x4c]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp dword [edx], ecx
ja 0x424d74
lea ebx, [edi + 0x30]
lea esi, [edi + 0xc]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
mov eax, dword [eax]
push eax
push ecx
mov dword [edi + 0x34], eax
call fcn.00424b80
add esp, 8
push eax
mov ecx, ebx
mov dword [esp + 0x28], 0
call fcn.00507e73
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00507d3a
mov ebp, dword [ebx]
lea edx, [esp + 0x18]
push edx
call fcn.00424b00
mov eax, dword [eax]
push ebp
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x34], 1
call fcn.00424830
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x28], 2
call fcn.00507e73
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.00507d3a
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call fcn.00507d3a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x424d3c
mov ecx, dword [esi]
and al, 0xfe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esi]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x424d74
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov edx, dword [esp + 0x30]
cmp dword [eax], edx
jbe 0x424c99
mov esi, dword [edi + 0x10]
cmp esi, 0xffffffff
jne 0x424d80
xor eax, eax
jmp 0x424dc5
mov eax, dword [edi + 0x28]
mov edx, dword [esp + 0x34]
cmp eax, edx
mov dword [edi + 0x18], eax
jae 0x424d99
mov ecx, eax
add ecx, eax
cmp ecx, edx
jb 0x424d90
mov dword [edi + 0x18], ecx
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [edi + 0x18]
push eax
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [edi + 0x14], eax
jne 0x424dc0
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x4c]
xor eax, eax
jmp 0x424dc5
mov eax, 1
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x425ba0
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
test eax, eax
je 0x425c4d
cmp byte [eax], 0
je 0x425c4d
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x425c4d
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x18]
push 0
mov eax, ebp
push ecx
push edx
sar eax, 0x1f
push esi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
push 1
push 0
push 0
push ecx
mov dword [esp + 0x20], eax
call fcn.004f2ba0
mov ecx, dword [esp + 0x10]
mov edi, eax
mov ebx, edx
xor edx, edx
add edi, ecx
push esi
adc ebx, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
cmp edi, eax
pop edi
jne 0x425c4d
cmp ebx, ebp
jne 0x425c4d
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x435b50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x520470
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], 0
lea edi, [esi + 0x14]
lea ebp, [esi + 0x10]
lea ebx, [esi + 0xc]
push edi
lea eax, [esi + 8]
push ebp
lea ecx, [esi + 4]
push ebx
push eax
mov eax, dword [esp + 0x30]
push ecx
push esi
push str._______i__i__i__i__i__i
push eax
call fcn.004f2884
add esp, 0x20
cmp eax, 6
lea ecx, [esp + 0x20]
jne 0x435bca
mov dword [esp + 0x18], 0xffffffff
call fcn.00507d3a
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 4
push 0
call fcn.00504bda
push str._r_n_t__.__
lea ecx, [esp + 0x24]
call fcn.00505538
push 0x20
lea ecx, [esp + 0x24]
call fcn.00505134
test eax, eax
je 0x435c1d
inc eax
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.00504f5c
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.00507e73
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0
call fcn.00507d3a
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x435c59
movsx edx, byte [ecx + eax - 1]
push edx
call fcn.0048d720
add esp, 4
test eax, eax
mov eax, dword [esp + 0x20]
jne 0x435c59
mov eax, dword [eax - 8]
push 1
dec eax
lea ecx, [esp + 0x24]
push eax
call fcn.00504bda
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
test ecx, ecx
jg 0x435c28
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x435c8d
movsx ecx, byte [eax]
push ecx
call fcn.0048d720
add esp, 4
test eax, eax
jne 0x435c89
push 1
push eax
lea ecx, [esp + 0x28]
call fcn.00504bda
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
test ecx, ecx
jg 0x435c60
jmp 0x435c8d
mov eax, dword [esp + 0x20]
push edi
push ebp
lea ecx, [esi + 8]
push ebx
push ecx
lea ecx, [esi + 4]
push ecx
push esi
push str._i__i__i__i__i__i
push eax
call fcn.004f2884
add esp, 0x20
xor edx, edx
cmp eax, 6
lea ecx, [esp + 0x20]
sete dl
mov esi, edx
mov dword [esp + 0x18], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x435ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x520488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
lea eax, [esp + 8]
lea edx, [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
mov dword [esi], 0
push edx
mov dword [esp + 0x34], 0
mov dword [edi], 0
call fcn.00507aaf
call fcn.00435b50
add esp, 8
mov dword [esp + 0x28], 0xffffffff
test eax, eax
jne 0x435d5c
lea ecx, [esp + 0x30]
call fcn.00507d3a
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0xc]
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 8]
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
shl ecx, 8
add ecx, eax
mov dword [edi], ecx
lea ecx, [esp + 0x30]
call fcn.00507d3a
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret
Function at 0x43c2d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x14], eax
call fcn.00515239
mov ebx, dword [eax + 0xc]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x43c32d
call fcn.00515239
mov ecx, dword [esi + 0x40]
mov ebx, dword [eax + 0xc]
push 5
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43c33b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x43c356
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.005087c9
mov edi, eax
mov dword [ebp - 0x20], edi
call fcn.0050965f
test edi, edi
mov dword [ebp - 0x1c], 0
je 0x43c38d
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x43c38d
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x2c]
call fcn.0050c575
mov dword [ebp - 4], 0
push esi
mov byte [ebp - 4], 1
call fcn.00509613
push edi
call fcn.00509161
mov edx, dword [ebp - 0x14]
push ebx
push eax
push edx
mov ecx, esi
call fcn.00508540
test eax, eax
je 0x43c41e
test byte [esi + 0x24], 0x10
je 0x43c3de
mov ecx, esi
xor ebx, ebx
call fcn.0050bcb5
test ah, 1
je 0x43c3d6
mov ebx, 1
push ebx
mov ecx, esi
call fcn.0050b5bb
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x43c41e
push 0x97
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.0050be26
jmp 0x43c41e
mov dword [ebp - 4], 0xffffffff
call fcn.0050c5b3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43c43a
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x43c450
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x43c450
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x58]
mov ecx, esi
call fcn.00508803
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x520d48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
mov dword [esp + 8], 0x2c
mov dword [esp + 0x10], 1
call fcn.00509c0e
test eax, eax
jne 0x43c66d
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov ecx, dword [0x569c90]
mov dword [esp], ecx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
push 1
lea ecx, [esp + 0x18]
push str._ld__ld__ld__ld__ld__ld_
push ecx
mov dword [esp + 0x58], 0
call fcn.005054dc
add esp, 0x20
call fcn.00515239
mov edx, dword [esp]
mov eax, dword [eax + 4]
push edx
push str.WindowPosition
push str.TEQueueDialog
mov ecx, eax
call fcn.00512506
lea ecx, [esp]
mov dword [esp + 0x38], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x30]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x43c800
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str..DEFAULTSoftwareGlobalSCAPECuteFTP_8_ProfessionalLauncher
push reloc.WSOCK32.dll_closesocket
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43c8a9
push edi
mov ecx, 0x40
lea edi, [esp + 0x21]
mov dword [esp + 0xc], eax
mov byte [esp + 0x20], al
mov edx, dword [0x55ff58]
rep stosd dword es:[edi], eax
mov ecx, dword [str.GUICmdLine]
mov dword [esp + 0x18], edx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x55ff5c]
mov dword [esp + 0x14], ecx
mov cl, byte [0x55ff5e]
mov word [esp + 0x1c], ax
lea edx, [esp + 0x10]
mov byte [esp + 0x1e], cl
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x43c89e
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x11c
ret
Function at 0x458680
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x522f28
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x38]
cmp edi, 1
jne 0x4586af
push 0x7e3
jmp 0x4586d1
cmp edi, 2
jne 0x4586bb
push 0x7e2
jmp 0x4586d1
cmp edi, 3
jne 0x4586c7
push 0x7e1
jmp 0x4586d1
cmp edi, 4
jne 0x4586d8
push 0x1473
mov ecx, esi
call fcn.0050cd58
mov eax, dword [esi]
mov eax, dword [eax - 8]
mov ebp, eax
cmp eax, 1
mov eax, 0x561bc8
jl 0x4586ee
mov eax, 0x560c40
push eax
lea ecx, [esp + 0x10]
call fcn.00507da8
push 0x561bc8
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0
call fcn.00507da8
mov ecx, 0x571fb8
mov byte [esp + 0x28], 1
call fcn.00482970
test eax, eax
je 0x458793
test edi, edi
je 0x458793
mov ecx, dword [0x569c90]
mov dword [esp + 0x38], ecx
push 0x400
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x38], 2
call fcn.004e9b59
mov ecx, eax
call fcn.004ea103
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push ecx
push str.__s_
push edx
mov byte [esp + 0x34], 3
call fcn.005054dc
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.00507d3a
lea eax, [esp + 0x38]
mov ecx, esi
push eax
call fcn.00508152
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 1
call fcn.00507d3a
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, esi
call fcn.00508116
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
test eax, eax
jle 0x4587ba
cmp byte [ecx + eax - 1], 0xa
jne 0x4587ba
dec eax
push 1
push eax
mov ecx, esi
call fcn.00504bda
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
test eax, eax
jle 0x4587d5
cmp byte [ecx + eax - 1], 0xd
jne 0x4587d5
dec eax
push 1
push eax
mov ecx, esi
call fcn.00504bda
push 0x55f080
push 0x55ecfc
mov ecx, esi
call fcn.00504da8
lea edx, [esp + 0x30]
lea eax, [esp + 0x38]
push edx
push 0x55ecfc
push eax
call fcn.00508043
mov eax, dword [eax]
mov ecx, esi
push eax
push 0x55f080
mov byte [esp + 0x30], 4
call fcn.00504da8
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 1
call fcn.00507d3a
mov ecx, dword [esp + 0xc]
push ecx
push ebp
mov ecx, esi
call fcn.00504cb6
push 0x55ecfc
mov ecx, esi
call fcn.00508116
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00507d3a
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4592f0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x523041
push eax
mov dword fs:[0], esp
sub esp, 0x154
push ebp
push esi
mov esi, dword [esp + 0x16c]
push edi
test esi, esi
je 0x45932b
mov ecx, 0x571fb8
call fcn.00480e50
test eax, eax
je 0x4594f2
xor eax, eax
mov ecx, 0x571fb8
test esi, esi
sete al
mov ebp, eax
call fcn.00480e80
mov esi, eax
test esi, esi
jge 0x459346
xor esi, esi
mov ecx, 0x571fb8
call fcn.00480e90
sub eax, 0
je 0x459371
dec eax
je 0x459369
lea eax, [esi + esi*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [eax + eax*8]
shl esi, 7
jmp 0x45937a
imul esi, esi, 0xe10
jmp 0x45937a
lea eax, [esi + esi*2]
lea esi, [eax + eax*4]
shl esi, 2
mov ecx, dword [str._PATH__DATE___LOGID.log]
push ecx
lea ecx, [esp + 0x10]
call fcn.00507da8
mov edx, dword [0x56ff04]
lea ecx, [esp + 0xc]
push edx
push str._PATH
mov dword [esp + 0x170], 0
call fcn.00504da8
push 0x55cf9c
push str._LOGID
lea ecx, [esp + 0x14]
call fcn.00504da8
push 0x55cf9c
push str._DATE
lea ecx, [esp + 0x14]
call fcn.00504da8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4593fc
lea ecx, [esp + 0xc]
mov dword [esp + 0x168], eax
call fcn.00507d3a
jmp 0x4594f2
push ebx
mov ebx, 1
push ebx
lea edx, [esp + 0x54]
push 0x55e51c
push edx
call fcn.0048d6e0
add esp, 0xc
test eax, eax
je 0x4594c2
push 2
lea eax, [esp + 0x54]
push 0x55e518
push eax
call fcn.0048d6e0
add esp, 0xc
test eax, eax
je 0x4594c2
lea ecx, [esp + 0x38]
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x24]
call fcn.005057ae
lea edx, [esp + 0x20]
push edx
call fcn.005057fa
mov eax, dword [eax]
mov edx, dword [esp + 0x1c]
sub eax, edx
test ebp, ebp
jne 0x459463
cmp eax, esi
jle 0x4594c2
push 0x55cfa4
lea eax, [esp + 0x1c]
push 0x56ff04
push eax
call fcn.00507fcf
lea ecx, [esp + 0x50]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x178], bl
call fcn.00507fcf
mov eax, dword [eax]
mov byte [esp + 0x16c], 2
push eax
call fcn.00422fd0
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], bl
call fcn.00507d3a
lea ecx, [esp + 0x18]
mov byte [esp + 0x16c], 0
call fcn.00507d3a
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x459402
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov dword [esp + 0x16c], 0xffffffff
call fcn.00507d3a
pop ebx
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x160
ret
Function at 0x45a0a0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5231a7
push eax
mov dword fs:[0], esp
sub esp, 0x154
push esi
mov esi, dword [esp + 0x168]
test esi, esi
je 0x45a2a3
push 0x56ff18
mov dword [esp + 0x18], 0x56ff10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [str._PATH__DATE___LOGID.log]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x164], 0
call fcn.00507da8
mov ecx, dword [0x569c90]
mov dword [esp + 0xc], ecx
push esi
lea edx, [esp + 0x10]
push str._06u
push edx
mov byte [esp + 0x16c], 2
call fcn.005054dc
mov eax, dword [0x56ff04]
add esp, 0xc
lea ecx, [esp + 4]
push eax
push str._PATH
call fcn.00504da8
mov ecx, dword [esp + 0xc]
push ecx
push str._LOGID
lea ecx, [esp + 0xc]
call fcn.00504da8
mov ecx, dword [esp + 0x16c]
test ecx, ecx
je 0x45a19c
mov edx, dword [str._y._m._d__H._M]
lea eax, [esp + 8]
push edx
push eax
call fcn.005058b3
mov ecx, dword [esp + 8]
mov byte [esp + 0x160], 3
push ecx
push str._DATE
lea ecx, [esp + 0xc]
call fcn.00504da8
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
mov byte [esp + 0x160], 2
call fcn.00507d3a
jmp 0x45a269
push 0x55cf9c
push str._DATE
lea ecx, [esp + 0xc]
call fcn.00504da8
mov ecx, dword [esp + 4]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45a213
lea ecx, [esp + 0xc]
mov byte [esp + 0x160], 1
call fcn.00507d3a
lea ecx, [esp + 4]
mov byte [esp + 0x160], 0
call fcn.00507d3a
mov edx, dword [0x56ff10]
mov ecx, 0x56ff10
mov dword [esp + 0x160], esi
call dword [edx + 0x14]
pop esi
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
add esp, 0x160
ret
push 0x55cfa4
lea eax, [esp + 0x14]
push 0x56ff04
push eax
call fcn.00507fcf
lea ecx, [esp + 0x44]
lea edx, [esp + 8]
push ecx
push eax
push edx
mov byte [esp + 0x16c], 4
call fcn.00507fcf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
call fcn.00507d3a
lea ecx, [esp + 0x10]
mov byte [esp + 0x160], 2
call fcn.00507d3a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0xc]
mov byte [esp + 0x160], 1
call fcn.00507d3a
lea ecx, [esp + 4]
mov byte [esp + 0x160], 0
call fcn.00507d3a
mov eax, dword [0x56ff10]
mov ecx, 0x56ff10
mov dword [esp + 0x160], 0xffffffff
call dword [eax + 0x14]
mov ecx, dword [esp + 0x158]
pop esi
mov dword fs:[0], ecx
add esp, 0x160
ret
Function at 0x45d9a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x523583
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0050f6c1
lea ebp, [esi + 0x10]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [ebp + 4], ecx
mov dword [ebp], 0x533f14
mov ebx, dword [esp + 0x2c]
mov dword [esi], method.CDC.virtual_0
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ecx
mov edi, dword [ebx + 0xc]
xor eax, eax
cmp edi, ecx
mov byte [esp + 0x24], 1
sete al
cmp eax, ecx
mov dword [esi + 0x30], eax
je 0x45da7b
mov eax, dword [esp + 0x30]
lea edi, [esi + 0x20]
cmp eax, ecx
jne 0x45da15
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x50]
jmp 0x45da1d
push eax
push edi
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.0050f778
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
push eax
sub ecx, edx
push ecx
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebp
call fcn.005100f0
test ebp, ebp
je 0x45da59
mov ebp, dword [ebp + 4]
mov edx, dword [esi + 4]
push ebp
push edx
call fcn.0050f8b9
mov ecx, dword [edi]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x24]
lea edx, [esp + 0x14]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0050fb48
jmp 0x45da8d
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8