joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489f70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ax, word [esp + 4]
pop edi
add esp, 0x208
ret

Function at 0x489fb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x48a083
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.0044d8e0
add esp, 8
test eax, eax
je 0x489ffc
mov byte [eax], 0
mov ebx, dword [esp + 0x114]
test ebx, ebx
je 0x48a07c
mov esi, dword [esp + 0x118]
test esi, esi
je 0x48a07c
lea edx, [esp + 0xc]
test edx, edx
je 0x48a07c
mov eax, dword [esp + 0x11c]
mov edx, 0x7a
test eax, eax
je 0x48a045
push eax
lea eax, [esp + 0x10]
push eax
push 0x643284
push esi
push ebx
call fcn.0044db78
add esp, 0x14
xor edx, edx
mov esi, edx
jmp 0x48a08b
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x48a078
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
jmp 0x48a08b
mov esi, 0x57
jmp 0x48a08b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x688760], esi
je 0x48a09c
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x104
ret
Function at 0x48a2a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5f4ad5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x664c18]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push 0x104
push ecx
mov dword [esp + 0x22c], 1
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x48a3c9
lea edx, [esp + 0x14]
push 0x5c
push edx
call fcn.0044d8e0
add esp, 8
cmp eax, ebx
je 0x48a333
mov byte [eax], bl
lea eax, [esp + 0x118]
test eax, eax
je 0x48a3c2
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x48a3c2
mov eax, dword [esp + 0x230]
mov edx, 0x7a
cmp eax, ebx
je 0x48a380
lea edx, [esp + 0x14]
push eax
push edx
push 0x643284
lea eax, [esp + 0x124]
push 0x104
push eax
call fcn.0044db78
add esp, 0x14
xor edx, edx
mov eax, edx
jmp 0x48a3cf
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x48a3be
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x118]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x48a3cf
mov eax, 0x57
jmp 0x48a3cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x688760], eax
je 0x48a3e1
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48a3f2
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x10]
call fcn.005df350
mov esi, dword [esp + 0x22c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005def3c
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], bl
call fcn.005df1c7
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x48a4f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x48a5ad
mov ebx, dword [esp + 0x114]
test ebx, ebx
je 0x48a5a6
mov esi, dword [esp + 0x118]
test esi, esi
je 0x48a5a6
lea ecx, [esp + 0xc]
test ecx, ecx
je 0x48a5a6
mov eax, dword [esp + 0x11c]
mov edx, 0x7a
test eax, eax
je 0x48a56f
lea edx, [esp + 0xc]
push eax
push edx
push 0x643284
push esi
push ebx
call fcn.0044db78
add esp, 0x14
xor edx, edx
mov esi, edx
jmp 0x48a5b5
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x48a5a2
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
jmp 0x48a5b5
mov esi, 0x57
jmp 0x48a5b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x688760], esi
je 0x48a5c6
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x104
ret
Function at 0x48ed80
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x30c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x669ba8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x48eecf
cmp eax, 0x104
jae 0x48eecf
push ebp
lea ecx, [esp + 8]
push esi
push ecx
call fcn.00489200
add esp, 4
test eax, eax
je 0x48ee42
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x110]
push 0x208
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00488df0
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 0x208
jge 0x48ee42
lea ecx, [esp + 0x110]
push esi
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0044d7e0
add esp, 0xc
mov byte [esp + esi + 0xc], 0
mov ebp, dword [esp + 0x31c]
test ebp, ebp
je 0x48eec0
mov edx, dword [esp + 0x320]
test edx, edx
je 0x48eec0
lea eax, [esp + 0xc]
test eax, eax
je 0x48eec0
mov eax, dword [esp + 0x324]
test eax, eax
je 0x48ee8f
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x643284
push edx
push ebp
call fcn.0044db78
add esp, 0x14
mov eax, 1
pop esi
pop ebp
pop edi
add esp, 0x30c
ret
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jbe 0x48eec0
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x30c
ret
xor eax, eax
pop edi
add esp, 0x30c
ret

Function at 0x4903b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x4903d1
push 0x57
mov dword [0x688760], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
test eax, eax
jne 0x490402
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x490402
test al, 0x10
jne 0x490402
test al, 1
je 0x4903cc
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
Function at 0x490470
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x490491
push 0x57
mov dword [0x688760], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x4904c2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4904c2
test al, 0x10
jne 0x4904c2
test al, 1
je 0x49048c
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x490aa0
Capabilities:
Move file

Disassembly:
sub esp, 0x824
push ebx
push ebp
push esi
mov esi, dword [esp + 0x834]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x490c64
mov edx, dword [esp + 0x83c]
mov ebp, dword [esp + 0x840]
cmp edx, ebx
jne 0x490ad5
cmp ebp, ebx
je 0x490c64
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bx
rep stosd dword es:[edi], eax
push edx
push esi
stosw word es:[edi], ax
push 0x64355c
lea eax, [esp + 0x430]
push 0x207
push eax
call fcn.0044cf6c
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x438]
add esp, 0x14
test ecx, ecx
jne 0x490b45
push 0x57
mov dword [0x688760], 0x57
call edi
push 2
mov dword [0x688760], 2
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push ebx
lea eax, [esp + 0x438]
push edx
push eax
mov dword [esp + 0x2c], ebx
call fcn.0049e5b0
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x490b70
test al, 0x10
je 0x490b8b
push 2
mov dword [0x688760], 2
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
push ebp
push esi
push 0x64355c
lea ecx, [esp + 0x20]
push 0x207
push ecx
stosw word es:[edi], ax
call fcn.0044cf6c
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [esp + 0x28]
add esp, 0x14
test edx, edx
jne 0x490c0a
push 0x57
mov dword [0x688760], 0x57
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x424]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x490c54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x688760], eax
je 0x490c76
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push ebx
lea ecx, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x2c], ebx
call fcn.0049e5b0
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x490bd4
test al, 0x10
jne 0x490bd4
push 0xb7
mov dword [0x688760], 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x824
ret
push 0x57
mov dword [0x688760], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x824
ret
Function at 0x492130
Capabilities:
Enumerate files on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x348
test edx, edx
jne 0x492159
push 0x57
mov dword [0x688760], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x348
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], 0
push 0x669c1c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push 0x643284
lea eax, [esp + 0x158]
push 0x207
push eax
mov dword [0x688760], 0
xor ebp, ebp
call fcn.0044db78
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebp
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x492228
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebp, 1
cmp byte [esp + 0x38], 0x2e
jne 0x492213
mov al, byte [esp + 0x39]
test al, al
je 0x4921f4
cmp al, 0x2e
jne 0x492213
mov al, byte [esp + 0x3a]
test al, al
jne 0x492213
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
jne 0x4921d9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x348
ret
push esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x348
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x688760], eax
je 0x49223e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x348
ret
Function at 0x492580
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x49259c
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0044d7e0
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.0044d920
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x492620
cmp byte [esp + 0x10], 0x5c
jne 0x492620
cmp byte [esp + 0x11], 0x5c
jne 0x492620
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.0044d920
add esp, 8
test eax, eax
je 0x49269e
inc eax
push 0x5c
push eax
call fcn.0044d920
add esp, 8
mov esi, eax
test esi, esi
je 0x49269e
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x492662
test bl, 1
je 0x492651
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x4926d4
cmp ebx, 0xffffffff
je 0x49266b
test edi, edi
jne 0x49267a
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x4926d4
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.0044d920
mov esi, eax
add esp, 8
test esi, esi
jne 0x492624
test ebp, ebp
je 0x4926d4
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4926c9
test al, 0x10
jne 0x4926d4
test al, 1
je 0x4926bc
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x4926d4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x4926f0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
test ebx, ebx
jne 0x49270c
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0044cea3
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.0044da60
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.0044cee0
add esp, 0x18
cmp eax, 2
jbe 0x492791
cmp word [esp + 0x10], di
jne 0x492791
cmp word [esp + 0x12], di
jne 0x492791
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0044da60
add esp, 8
test eax, eax
je 0x492819
add eax, 2
push edi
push eax
call fcn.0044da60
add esp, 8
mov esi, eax
test esi, esi
je 0x492819
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x4927d9
test bl, 1
je 0x4927c8
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x49284f
cmp ebx, 0xffffffff
je 0x4927e2
test edi, edi
jne 0x4927f1
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x49284f
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.0044da60
mov esi, eax
add esp, 8
test esi, esi
jne 0x492799
test ebp, ebp
je 0x49284f
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x492844
test al, 0x10
jne 0x49284f
test al, 1
je 0x492837
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x49284f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x492860
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push ebp
push esi
test ebx, ebx
push edi
jne 0x492894
push 0x57
mov dword [0x688760], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4928bb
test al, 0x10
jne 0x492a23
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x492a23
mov ecx, 0x81
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0044d7e0
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.0044d920
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x49294a
cmp byte [esp + 0x10], 0x5c
jne 0x49294a
cmp byte [esp + 0x11], 0x5c
jne 0x49294a
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.0044d920
add esp, 8
test eax, eax
je 0x4929c8
inc eax
push 0x5c
push eax
call fcn.0044d920
add esp, 8
mov esi, eax
test esi, esi
je 0x4929c8
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x49298c
test bl, 1
je 0x49297b
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x492a00
cmp ebx, 0xffffffff
je 0x492995
test edi, edi
jne 0x4929a4
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x492a00
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.0044d920
mov esi, eax
add esp, 8
test esi, esi
jne 0x49294e
test ebp, ebp
je 0x492a00
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4929f1
test al, 0x10
jne 0x4929fc
test al, 1
je 0x4929e6
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x492a00
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
jne 0x492a23
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x688760], eax
je 0x492a16
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
mov eax, dword [esp + 0x220]
test eax, eax
je 0x492a36
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret
Function at 0x492f40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x154
push ebx
mov ebx, dword [esp + 0x15c]
push ebp
mov ebp, dword [esp + 0x164]
push esi
mov esi, dword [esp + 0x16c]
mov eax, 0x1f3
push esi
sub eax, ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x492f89
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x154
ret
push edi
mov dword [esp + 0x10], 1
mov eax, dword [esi]
test al, 0x10
mov dword [esp + 0x14], eax
je 0x4930f1
mov al, byte [esi + 0x2c]
lea edx, [esi + 0x2c]
cmp al, 0x2e
jne 0x492fc4
mov al, byte [esi + 0x2d]
test al, al
je 0x493119
cmp al, 0x2e
jne 0x492fc4
mov al, byte [esi + 0x2e]
test al, al
je 0x493119
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x20]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
inc ecx
cmp eax, ecx
jb 0x493119
add ebp, ebx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x174]
and ecx, 3
test dl, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x49303c
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0
push ebx
call dword [esp + 0x188]
mov edx, dword [esp + 0x174]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4930a8
test dl, 0x40
jne 0x4930a8
mov esi, dword [esp + 0x1c]
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
mov byte [esi + ebp - 1], 0x5c
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x170]
push ecx
push edx
lea edx, [esp + 0x30]
lea ecx, [esi + eax + 1]
push edx
push ecx
mov byte [esi + ebp], 0x2a
push ebx
mov byte [esi + ebp + 1], 0
call fcn.00492f40
mov edx, dword [esp + 0x18c]
add esp, 0x18
mov dword [esp + 0x10], eax
jmp 0x4930ac
mov esi, dword [esp + 0x1c]
test dl, 0x20
je 0x4930d9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4930d9
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push ebx
mov byte [esi + ebp - 1], 0
call dword [esp + 0x188]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x170]
mov byte [ebp - 1], 0x2a
mov byte [ebp], 0
mov ebp, dword [esp + 0x16c]
jmp 0x493119
mov ecx, dword [esp + 0x17c]
lea edx, [esi + 0x2c]
push ecx
push eax
push edx
push ebx
mov byte [ebx + ebp - 2], 0
call dword [esp + 0x188]
mov byte [ebx + ebp - 2], 0x5c
mov dword [esp + 0x10], eax
mov byte [ebx + ebp - 1], 0x2a
mov edi, dword [esp + 0x10]
test edi, edi
je 0x493135
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x492f92
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x154
ret